The cloud backup bothers me way more than a phone number leak. If I accidentally tap the wrong button my shit is instantly uploaded. No way to know you haven't been pwned by the NSA.

i think they do the phone number thing to enable syncing between devices, so have server side processes. and are not particularly good at securing those data.

As a security specific offering having there own security being flawed is never a great look i guess