Are you sure about that? I don't think this is true. I definitely don't have a phone number linked to my Google Account and I have TOTP enabled as well. They even have the Advanced Protection mode which doesn't allow SMS or the authenticator app.
Really though, you should do the last thing. Buy some security keys and enable Advanced Protection.
Only then you can add other authentication methods (this a hardware key) and remove your phone as an option.
Source: went through this nonsense a couple years ago and then again a couple months ago with a different account.
There is ABSOLUTELY an option to enable 2FA on a Google account now that does not require giving them a phone number. There's a clear "Advanced Options" link that lets you choose a security key, which is what folks should be using anyway.
Other than security key, it's only phone number or adding account to the phone.
I'm sorry I didn't mention that in my post, I wasn't trying to lie, I just can't obtain physical key and I don't think I have to have physical key to read my emails.
If there is a way of doing it, I suspect it's deliberately well hidden. I also suspect what they enforce varies by country.
Besides, you don't need an actual physical key for U2F.
I set up 2FA to use Yubikey hardware keys for a google account, and was then allowed to generated app passwords. No phone number has ever been attached to the account.
I do agree that not allowing app-passwords to be generated without setting up 2FA is coercive and seems hard to justify, and it is plausible that it is being used to push people into attaching their phone numbers to their accounts. If I recall right, the current language for the setup process skews heavily toward phone numbers and does not do a good job of highlighting other (more privacy oriented) alternatives (as may be evidenced at least in the case of OP).
If now it's just 'not recommended' then this is an improvement.
So the rules can vary by region
I'm really glad that I've never used a gmail address for email before, I'd hate to be stuck with using anything run by Google.
Companies using google apps, keep in mind, you pay money for a service but if there's google involved, you're still a product, just avoid it
My personal consumer MSFT/Xbox account also has no mobile number attached.
Most of our people including myself choose to enroll a personal phone rather than carry two devices, and somehow none of these hundreds of people ever provided their mobile numbers to Microsoft. I think you are mis-remembering the setup experience, or your employer chose to enable some non-default options that uses SMS as a backup option to the app.
You always need to add a phone as your first MFA method.
A simple hack though:you can add other methods, then remove phone.
Your account was likely created before phone MFA was mandatory (as the first method).
Sure. That's like when I deleted my DigitalOcean account. They still send me notices about their service. Just because something is deleted for you doesn't mean it's deleted for them.
If you use an Android phone, you most definitely do have a phone number associated with your Google Account. Android sends your IMEI and SIM card info to Google servers.