This move to 2FA and phone mobile numbers is not about protecting users of central services, it's about protecting the corporations that run the central services. Individual users are a liability to central services. They are only important in the aggregate. These policies move risk around with indifference to the welfare of users (I don't say customer because the user is typically the product) in order to reduce risk for the service. Try thinking about mitigated risk like trying to keep things clean: you can't get rid of dirt you can only push it around. As a design can sometimes come from a clean slate, it's possible to keep things clean with good design. But the motivation of business is not hygiene, it's profit.