Requiring a phone number also seems like a decent way increase friction for automated account creation - obviously it can be overcome, but it probably reduces automated account creation by a few orders of magnitudes, which I would imagine reduces the amount of botting/phishing/ban evasion, which could all add up to be pretty expensive to an org.