the only reason its not worse is because nobody's leaked a phone number database yet with accuracy regarding who is using it for 2fa. Currently strangers can't look at a list of phone numbers and tell if they are used with Instagram or Facebook and if that account is even valuable, quickly.

just security through obscurity.