Consumers and businesses alike must be encouraged to turn on things like two-factor authentication wherever possible
No, I am not giving that bunch of idiots my phone number, it'll get stolen in the next hack (isn't there one due round about now?).
The company recommended that users consider adopting its Yahoo Account Key, an authentication tool that eliminates the need for a password.
Yahoo Account Key also needs your phone number, if they really had your security in mind this would not be necessary.
Also, it's doubtful this advice works, it seems that hackers can just manufacture session cookies without any need to log in. That's how shit Yahoo is.