A time-weighted average makes manipulation a matter of duration rather than a single block. To move a 30-minute average by 10%, an attacker must hold the spot price away from fair value for many blocks, exposed the entire time to arbitrageurs who will happily trade against them.
The cost is lag. During a genuine fast move the TWAP reports yesterday's news, which can leave a lending market valuing collateral above its real price and accumulating bad-debt, or delaying liquidations that should already have happened.
So the window length is a direct trade between manipulation resistance and staleness, and different protocols make the trade differently. Short windows suit deep, liquid assets; long windows are a sign the underlying market is thin enough to worry about.
Related: oracle, oracle-manipulation, stale-price-risk, price-feed-aggregation