Yes, that is exactly how it work. It's uses your social graph.

That was you have a way of sanity checking the other party.

You only see offers when you have contacts in common. If need be, you reach out to you contact in common and ask 'you know this person'?

Your contacts are hashed, and matches are done on those hashes. On one presentation I saw, they said they don't want your private information, because they would need to protect it then.

As for requiring your number, it's spam mitigation, you can use a burner number all the same.

The system you have describe would unfortunately be flooded by spammers. This unfortunately is the nature of the internet.