Obviously writing an ads targeting system wasn't an accident. But why did it end up using data it wasn't supposed to? It seems unlikely that it was expressly written to work against data they weren't supposed to use for that purpose. It's much more likely that they had multiple data sources for email addresses and phone numbers, and had cross-contamination between the data sources.

E.g. maybe they at some point had dozens of databases for user data, all maintained by different teams and grown organically. And then had a big effort to merge them into a single system with a rationally designed schema. And maybe they ended up coalescing all phone numbers of each user from all sources together, with some kind of annotations for why each phone number was collected. And then it's very easy for somebody to screw up the code that's supposed to filtering out security-only phone numbers when ingesting data into the ads targeting system.

The above was totally theoretical scenario, but it should be easy to come up with lots of other ways for this to happen by mistake rather than intentionally. Don't think companies make these kinds of mistakes? Both Facebook and Google had issues with plaintext passwords this year. And it should be obvious that neither had anything to gain from that.