You're overestimating how long it takes to brute force SHA256 all 10 digit phone numbers from scratch.
Take this with a grain of salt though, I did not test the speed claim myself.
Oooookay. I'll show myself out.
/s
Security should not be implemented by anyone who is not a subject matter.
It's a subject where it's easy to sound informed while being completely wrong.
I'm of the opinion this should be a development interview question.
"How would you implement {security solution} from scratch" -- The only acceptable answer being refusal.