Someone's old number might be your hidden number if you use an MVNO.
This isn't outside of theoretical possibility, but isn't a universal problem with MVNOs outside of a very small handful of low quality ones that're on Sprint/T-Mobile and either offer WiFi first or port number in after activation setups, such as Republic Wireless and Mint Mobile. Most MVNOs actually work just like regular carriers, and your real phone number is actually what's tied to the SIM card's IMSI.
I'm far more inclined towards the blind phishing/spam likelihood, possibly based on
the recent n-day watering hole exploit that Google recently patched. Either the phone was lined up to do a massive fingerprint dump and got kicked to Google by the malicious party, or the system was patched by Google to bypass the possibly already known exploit URL entirely... though these sorts of scam spam text links are rarely so sophisticated.
Resetting Amazon and Google passwords on another device that isn't your phone and kicking out all logged in devices aren't a terrible idea. Nor is checking for any new apps installed on the phone. The paranoid, tinfoil-hatted version of my inner sysadmin wants to tell you to secure wipe your device and set it back up, but that seems a touch excessive when I read it actually typed out, even if it's not wholly unwarranted.
Either way, this is why I don't recommend handling sensitive accounts on a smartphone, and to use TFA based on code generators instead of text messaging to mobile numbers whenever possible.
