To address the app and phone number concern I have; I doubt it's possible to remain a user of Google services without being forced to give them my phone number at least once, and even if they don't keep it, they'll keep a hash of it to bypass the spirit of the law, and track me across data brokers using a derivative of my phone number instead.

My guess is, if they aren't nagging you about verification by phone number, you've likely provided them with your number at least once in the past.

On a related note, there's been a push for supporting the Payment Services Directive (PSD2), which requires strong customer authentication (SCA) in most cases, which implies 2FA.