This is one of the most important pieces of security advice that is often overlooked: remove your phone number from EVERYTHING.
You can also enable Advanced Protection[1] for your Google account, but other repeat offenders like Github will continue to allow SMS fallback to bypass 2FA if you have a phone number listed anywhere.