That’s expected as each connection strategy has different capabilities, even if they share the same API2 endpoint for user management.
phone_number is ONLY allowed in the root user profile when using SMS connection. It is not a simple change in the array.
I suggest you to add feedback here Auth0: Secure access for everyone. But not just anyone. so appropriate product manager can take a look at the request.