i think they do the phone number thing to enable syncing between devices, so have server side processes. and are not particularly good at securing those data.

As a security specific offering having there own security being flawed is never a great look i guess