> What scenario does a kiosk at the mall get control of my phone number but not control of my phone?

You can e.g. smooth-talk the customer service at a kiosk to give you replacement SIM card for the one you've "lost".

This is why banks increasingly don't trust your phone number, and their apps tie themselves to the phone itself, i.e. to hardware and OS IDs. But to trust those IDs, they need the phone to pass remote attestation.