Yeah, allowing someone to enter an arbitrary phone number is actually worse security than sending the confirmation code to the email address associated with the account.