They seem to require a phone number for all new accounts. My guess is that they A/B tested it, and locking accounts after creation had better metrics than requiring it during the sign up process.