It's trivial to get these values from software and it is (was) a very common practice amongst app developers, advertisers etc. to collect this information and store it in a database. I can guarantee you that the IMEI in the majority of these databases is stored as plaintext. Due to the easy access to these numbers as well as the large number of massive existing databases of them, IMEI numbers are simply not suitable password equivalents in any way and merely suggesting the contrary makes our world a less secure place.

The IMEI is harder, but any one who can grap your phone can enter *#06# to get your IMEI. Also, it's available on the box of your device, and many apps store the IMEI to identify your device.