Getting someones phone number seems pretty insignificant compared to using a previously undisclosed google security flaw.

And it's probably safe to assume that once you control the admin email account for a site, it's game over. You could request resets from other providers