In this case, Twitter was lying (or more generously, not being entirely truthful) with what they were using the data for. Some users may have chosen not to give up their phone number or email if they had known it would be used for advertising in addition to account security.
When signing up for a "free" service, I basically assume all data entered will be used for advertising / marketing purposes. This is a safe assumption to make.
I don't disagree, but I think we should still be able to get upset when a free service uses the data for something other than what they said it would be used for.
It's why I love GDPR. Since it requires explicit, opt-in consent, I can just register or visit a site and don't worry much - abuse of my data is a bigger risk to the service than it is to me.
In fact, prompting every time is also a red flag. They wouldn't be so desperate if providing the number was for your benefit as they claim (for "security", etc). The real reason they're so desperate is because it's for their benefit.
