That's the conspiracy. They don't need phone numbers for that.
It's mainly security with a sprinkling of spam/bot reduction.
Do you really think NPM and PyPI are doing it to improve their targeted advertising?