I think those who think this misunderstand the type of security it is meant to provide. It's not about blocking account takeover attempts. Services mostly don't really care about that, because it doesn't affect the service as a whole. It's about reducing spam, bots, and other organized hostile activity towards the service as a whole. It's tough to create a bunch of accounts in a way that the site can't easily track if you have to provide a real phone number. Yes, everybody knows about buying phone services on the internet, and they do seem to have ways to block using those numbers.

Pretty much every service does this. Try signing up for a Google, Facebook, or Twitter account without providing a real phone number. Usually if it works at all, the account created will be rapidly blocked until you do provide one.