Twitter removed basic auth, yes, but it didn't remove Username/Password auth.
See their documentation on xAuth.
In a nutshell, you collect the user's username and password, and on successful verification, store the OAuth token and discard the username and password.
xAuth is explicitly allowed for certain applications, approved only from Twitter. It's not a stretch to say that Twitter would have approved Apple's request to use this in a heartbeat. The lack of ability to access Direct Messages via xAuth is limiting, but ultimately not relevant given the level of Apple's integration.