The TCPA requires express written consent to send marketing messages or phone calls to any personal phone number. Legal precedent dictates that online, this usually takes the form of a specific checkbox on the form where you're giving your phone number saying that you agree that the company can use the phone number for marketing purposes. I doubt Meta collects this type of express written consent for your 2FA phone number, but I guess it's possible.

There indeed used to be an exemption to the law involving an existing business relationship, but 1) this was only for residential land lines and never applied to cell phones, and 2) it was revoked on October 16, 2013. [1]

[1] https://tcpablog.com/new-tcpa-regulations-take-effect-on-oct...

I'd assume in this case that they'd be allowed to call his business.

It sounds like his personal contact details are entirely separate from his business ones. I don't believe they should ever be using personal details to contact a business.

Even if he did provide them his phone number. In many places, that data may only be used for the purpose for which it was given. If they request a phone number for 2FA and then use it to contact you it could absolutely be considered illegal.