Exchanges have many ways they plot just to get our data, I'm a victim of this phone number stuff, and I use 3 processes of authentication including my phone number. I think I have to do something about this.
I remember I had such a security set on binance (when it was still without KYC). For each operation, as many as 3 codes were required: an authentication code, a code from email and a code from SMS. This is a real bust, especially if you use the exchange every day.