I’m not seeing that. If Facebook recognizes the phone number, it offers to send an SMS to that number or to send an email to an obfuscated email address (like r***@***).
At most, you learn that the user’s email starts with an “r” as in example above. And possibly the numbers of letters in the username, but my experiments indicate that Facebook is not telling you the precise number of asterisks to deduce the length.
Maybe when you tried it, you were using a known device (eg., having an IP address from which you logged into Facebook on an earlier occasion), and therefore Facebook was offering you more detail, such as your username. Could you try a random phone number from the 533M leaked numbers and see if you still get the username?
At a minimum, what this search allows is confirmation that a phone nnumber is associated with an existing Facebook account.
But, if it is GET requests in the URL over http, yeah, that is leaving a trail.
Any 3rd party JS analytics has access to everything, though.