Now the other site knows the phone number (they know what was sent, and they see what was replaced by asterisks). And now they can exfiltrate all the sensitive

Now the other site knows the phone number (they know what was sent, and they see what was replaced by asterisks). And now they can exfiltrate all the sensitive phone numbers -- just sending clients (you) long strings of numbers, and see what was replaced.