I wouldn’t say it costs you anything, since they aren’t using the number for their own gains, as far as I can tell. I’ve been using two factor authentication from them for years, and haven’t noticed Google, or anyone else calling me at a higher rate than before. Also, I have an Android phone, so they have my number already.
The only way they could implement, and goad users into using, stronger security without a phone, is some sort of fob… Which wouldn’t be as useful, since you couldn’t get SMS notifications and recovery. Email wouldn’t work, as its tied to the potentially comprised account.
