I'm surprised people didn't know this... this has been happening for at least 4 years through custom audiences. An advertiser can upload a list of mobile numbers or email addresses to target people.
Actually this should be an act of "good faith" where you are adding a layer of security to your account and not about making even more harm to your account.