This doesn't involve a phone number, and I haven't enabled 2FA either. This is a security check that's activated under some combination of unfamiliar location, WiFi network, or device. It requires you to confirm your identity by using the app.

If you delve though GMail's settings, under "Sign-in and recovery":

  Trusted mobile devices
  Google can verify that it's you by sending sign-in notifications to a private 
  phone or tablet. You can remove it in your recently used devices.

There's no way to turn it off as far as I can see. You can remove a device from the authorised list, but that's not very helpful if you don't realise that it's been added.

It's idiotic. It's essentially: "confirm that you're allowed to access your email by confirming that you already have access to your email".

Goog did it to me too. I was using a burner phone, and logged into the Goog account. Next thing I know, after I chucked the burner, Goog is demanding I authN using the burner phone.

If you are wondering how I authenticated the first place onto the burner, I used TOTP, but she would not let me use it again; she wanted my burner.