The benevolent interpretation is that they are doing it to fight scraping and fake followers. The prompt you get for suspected scraping or botting is along the lines of "complete an SMS 2FA challenge within 24 hours or be banned forever", but maybe the first step when you don't have a phone number connected looks like what you experienced.
