Phone numbers aren't required now. But there are flaws in Signal. Your phone usage can be tracked in high resolution through constant pinging of malformed status messages. I can't find the paper right now but researchers found that they could track their own data about when the phone was on, unlocked, and had Signal on the screen. That can be correlated between users, to see who is talking to who. It can be used to try to ambush you while the phone is unlocked. You don't even have to have a connection to the spies, if I remember right. Signal devs have done nothing about this issue since being notified like a year ago.

Edit: Found it! "Careless Whisper: Exploiting Silent Delivery Receipts to Monitor Users on Mobile Instant Messengers" https://arxiv.org/abs/2411.11194