If Google detects something strange or is just feeling particularly chaotic that day, they will lock the account and require you to verify it using the phone nu

If Google detects something strange or is just feeling particularly chaotic that day, they will lock the account and require you to verify it using the phone number. Even if you don't have 2FA enabled.