If you used that phone in the past with google services that's the reason it bypassed sms. When using a fresh android on a vpn and off a vpn, I've been prompted for phone numbers.
The best bypass not attaching to previous accounts or identities i found was creating on hotel or public networks. I was able to set up accounts for nvidia shields on hotel networks and bypassed the sms verification. After taken home they were placed on a subnet that only talks to the local server.
Some networks are whitelisted where as others they treat as VPNs (like the school). For instance apple stores or retail stores you might have greater success as they typically whitelist most of those locations.
Device type will also make a difference because google is a pita.