I assume you still had access to your old phone and could approve the transfer from it. If not, then your phone number is your password, which is even worse, in my opinion (it’s basically public information).