[jiveturkey]

Twitter is one (of several) companies that have used your required phone number for marketing purpose. How is it you think they have any care about best practices?

Anyway, this is about shifting liability with minimal effort. As such, I'd consider it best practice. Of course, I'm using that term in a different way than you, but you just need to appreciate the goal here. It's not at all about "authenticating" you as a heretofore unknown, authorized member of the org -- that's extremely difficult, even at small scale.