Your account didn't get hijacked because you didn't set up a phone number or because you didn't read your recovery emails. Your account got hijacked because you

Your account didn't get hijacked because you didn't set up a phone number or because you didn't read your recovery emails. Your account got hijacked because you reused a password or installed malware, and didn't set up 2FA. There was no "spam vs security" trade-off here. Not setting up the account with sufficient recovery options is responsible only for your inability to recover it, not for the hijack itself.