Google proved this to me a few years ago. I have a few alternate Google accounts that I setup to use only one of their services. I hadn’t logged into one of these in a few years, and that was from a different IP address, so it bugged me to verify I was the account owner. My password database showed that I had setup an alternate email address for this account for this kind of verification. I had never given Google a phone number for this account. Google ignored that email address. Instead what Google essentially told was “We don’t believe you are really windowsaturn. We think you may be an imposter who stole windowsaturn’s username and password. Whoever you are, if you give us your phone number now we will let you into windowsaturn’s account. Google was not trying to protect me. Google only wanted my phone number. Thankfully I didn’t need the account badly, so I left it for dead.