The full sentence states:
While no passwords were exposed, we encourage everyone who uses Twitter to enable 2-factor authentication using authentication apps or hardware security keys to protect your account from unauthorized logins.
So it actually does not imply adding a phone number, which is seemingly what you have tried to imply with the cut-off quote provided.