once your number is leaked or a database hacked its out there forever and this sort of stuff happens all the time
i blame everything insisting on two factor authentication even though i couldnt give a shit about my google account and stuff
i wouldnt be surprised if google just sell them desu since theres no good reason they *need* one