I cant find any information that discusses the security risk. But it would seem that this transfering all content to the owner of the phone number is a standard feature.
So, maybe its not discussed because it doesn’t frequently happen.
It doesnt seem like a trustworthy way to ensure users content remains secure.