Well, what else are you going to use for a secure personal identifier? Email? Credit card? Neither of those are especially more secure, and it's at least slightly harder to get a new phone number (and much harder to get a specific phone number) than an email address. This raises the cost of spam slightly.

Systems which actually need to secure a large amount of digital valuables or face customer complaints (i.e. games) get their customers to use hardware tokens or mobile-based 2FA.