Microsoft locked my account (one week after forcing me to migrate from my Mojang account), and they require a phone number for “verification”. They don’t have anything to verify against however. So if someone malicous had gained access to my account, they could just enter their own number and the account is theirs to keep I guess ¯\_(ツ)_/¯