Twitter hasn't my phone number, just checked. Maybe is it because my account is old?

Yes. But even with an old account, if you sign that up freshly to the developer program they'll force you to provide a phone number, and can require you to go through the approval process for higher API access even if you don't want that.

My Twitter account also has no phone number, but it gives me an error about it if I try to sign up for API access.

Agreed, while there are tons of spambots, they are likely scraping Web API and using some backdoor-ish thing to get around requirements than using the documented API.

This announcement and today's ban-wave that followed seemed like someone not accustomed to Twitter just knew there are bots, and thought it to be workable idea to sample global timeline and script ban duplicates, which of course is not workable at all and only maximize harm on real users.

It is trivial to buy 1000's of phone numbers with SMS all available through APIs. You don't even need to keep them. The grey web is filled with many of these services.

If I looked hard enough I could probably buy 10000 verified twitter accounts with API access right now, aged 1 year or older.

Where can you buy actual mobile phone numbers? (Not VoIP numbers)

I would think mobile carriers keep that in their own house

I think I've encountered some nefarious discussions around obtaining SS7 bulk access endpoint and intercepting SMS?

Yup. PVAs can be had for a couple of $, with the price going up if they're 'warmed' (with a history of innocuous activity, usually liking celebrity tweets, retweeting the occasional breaking news story or heartwarming puppy video etc).

Furthermore, every time I create an API service, I get immediately banned (before I do anything) over and over until I truly prove that my bot is in good faith. They are super aggressive, and they actively enforce their rules (in the past, I've tried to make bots that reply to folks - that don't follow me - and the bot lasts like four hours).