They do require it. If you remove it 2-factor-authentication is disabled.

Nothing says that number needs to be your mobile (or one that you have regular access to) but you do need to provide one.