One of my workplaces has sold their email hosting to Google. (I've never been happy with this, but they pay me enough to keep the dissatisfaction down to grumbles now and then.) They've broken their backends badly enough that I have to use some horrible webmail interface — tolerable, but not by much.
Today, I was sitting in that interface when they booted me back out to the signin page. So I went to sign back in...and after my giving them the email and password, it wanted a phone number(!), saying it was to verify it was really me.
Obviously, all this would verify is that whomever is trying to sign in has something that can receive a text; it is of low-to-negative value when it comes to verifying that that person is actually the person to whom the account is supposed to belong.
So I contacted — and not by email — the mail admin at that company, the one who set up that address for me. He said they were trying to do "what they think is 2fa" ["2fa" meaning two-factor authentication].
If they already had a phone number, specified at account setup time, that would actually be 2FA. But this? It's hard to believe Google is stupid enough to think this is actually 2FA, so I can only assume they are just hoping people are too stupid to see through their pretense.
In this case, I have a work "smart"phone from the same job, so I gave them that number. I don't know what they think I would have done if I had nothing that could accept texts. Maybe they want to shed such users.
Since this new hoop to jump through doesn't actually secure anything, I don't see any reason for this except a desire to scrape more PII from their product (users) to sell to their customers (advertisers). This is, after all, the company which brought us privacy invasion as a business model.
EDIT: Approximately an hour and a half after I went ahead and gave the work phone number to Google, I got two identical scam texts (within about ten minutes) talking about my CIBC access card, which is something I don't have. I can't recall the last time I got such a thing; it's been months at the very least, I think more like years. This is not quite up to trout-in-the-milk[1] levels of circumstantial evidence that Google sold that number, but it's getting there.
[1]^ This is a reference to a quote I saw somewhere, though I forget the attribution: "Sometimes circumstantial evidence can be very convincing, as when one finds a trout in the milk", this talking about milk being watered down (in a time-and-place when that was still a thing).