Yeah, this is basically the same thing that happened with social security numbers. Companies promised only to use it to verify they had the correct credit file, but +/- 90 years later it's a defacto ID that no longer has any security value.

Edit: I suppose phone numbers can at least be changed, but that doesn't really solve the problem for 2fa as it might for SS numbers.