They do in GDPR jurisdictions or they’re fucked.
They'll pay a fine, perhaps, but it's not like Mark Zuckerberg will be laying in a gutter pissing blood.
Regardless, you can't put the cat back in the bag. Bad actors will still have scrapped your number, or way too much personal identifying information, anyway.