Specifically, the endpoint allowed asking if a given phone number had a whatsapp account. Scaled up to ~all phone numbers. That doesn't seem like a major vulnerability.
I've never understood this idea that phone numbers shouldn't be protected the same as email addresses or other personal information.
Email, of course, has an unlimited number of possible addresses. Phone numbers are a dense space with limited parameter length. So it is easier to enumerate all phone numbers.
I assume it can be related to this leak? Knowing someone uses a service can increase the effectiveness of targeted phishing.
Interestingly it’s harder to block these senders that do not advertise a number on sms.