People ask me why I do not use a phone number - this is one reason:
https://googleprojectzero.blogspot.com/2023/03/multiple-internet-to-baseband-remote-rce.html

> ... allow an attacker to remotely compromise a phone at the baseband level with no user interaction, and require only that the attacker know the victim's phone number.