Wanted to check if I’m just dumb, and all recent answer point to the same issue: https://www.quora.com/Is-it-possible-to-use-Google-2-step-ve...
Either that answer is out of date or it's lacking nuance. I haven't done it in a while, but it may be that you need SMS 2FA initially, and then once you've added TOTP you can then remove SMS.
But SMS is absolutely not required and anyone who thinks it is and is avoiding 2FA for that reason needs to go take a second look at their security settings.
What I was pointing at is not that SMS is the only option but that the phone number + confirmation seems mandatory at least once.
I deleted my account with Digital Ocean years ago, because I use NoScript and every time I went to a new page at DO, it required me to enable more 3rd-party domains. I switched to Vultr.com because they only use their domain for their web pages.
Recently I received an email from DO that my acct information may have been accessed by some hack. I replied to that email, requesting that they delete everything on their systems relating to me. They said I had to sign in and purge my account. I already did this, when I switched to Vultr.com. But I tried anyway. It wouldn't let me sign in (Duh! I already deleted the account), so won't let me purge my info. When I explained that DO would have to delete it, they never replied. They obviously still have my info or they couldn't have emailed me.
My level of trust that a company has actually deleted everything they say they are deleting is about zero. If it's to their advantage to keep it, they will.
This and your other reply in this part of the conversation are purely paranoid speculation.
Frankly, if you're this concerned about Google's nefarious intent, you should get off their platform. They probably already know a lot more about you than just some random phone number.