2 is full on speculation. It can be any kind of purpose.
Yes, a lot of compromised accounts are just put onto a marketplace of sorts, either selling the account itself directly or offered as services to promote a product / political talking point / propaganda / engagement.
Or it could just be that someone vibe coded the worm, and vibe coding is relatively young.
I like how quickly this got dismissed as speculation as though we don't live in an age where election tampering and manipulation of public opinion for political reasons are so commonplace that incidents of it just blend in with the other forgettable global headlines.