I had a gaming-only Microsoft account locked in the same way and I can guarantee you there is no successful credential-stuffing attack against it (even the username was secret, as it was random and not used anywhere else).

Locking accounts for "security reasons" and requiring a phone number is a common tactic to harvest phone numbers for "growth & engagement" reasons. Twitter does that since a while ago and recently got caught "accidentally" using those numbers for tracking reasons.

The security argument doesn't make sense because if they don't already have an existing phone number to compare to, they can't authenticate the newly-provided phone number - if the account was actually breached, the attacker will trivially bypass the restriction by just providing a phone number they control and take over the account anyway.