I wonder if that last step shouldn't be followed by a GDPR notice to stop processing your phone number, if you're in Europe - because I don't imagine they aren't storing your number anyway, after you remove it from auth options.