They do (and any service basically). You don't want to run a large-scale service without having some way for your users to self-reset their passwords.
> They surely don't need my phone number or any other information about me.
That requirement is recent and I believe comes from law enforcement / politicians as they want to be able to track "hate speech" (that's the official speech, but rather I believe it's about dissidents, YPG supporters etc) to real persons. Many left-wing German accounts had them frozen until entering a phone number, for example. Facebook is easier because many people use their real name and photographs or other personal details from which law enforcement can identify them.