That would be dangerous: it would be much easier to mine haveibeenpwned by enumerating phone numbers and see what sites have been hacked with a certain number.

That would be dangerous: it would be much easier to mine haveibeenpwned by enumerating phone numbers and see what sites have been hacked with a certain number. You would then know exactly which sites to target with which phone number, and that's already eliminating a lot of work. Get a password dataset or two in the darknet and you can now hack into many accounts.