Google Two-Step: Is it safety, or future potential?

"Two-step verification is easy to set up, manage and use. When enabled by an administrator, it requires two means of identification to sign in to a Google Apps account, something you know: a password, and something you have: a mobile phone."

Google has recently announced a new system for some of their applications that requires the user to verify through SMS with a secondary level of security.  They've started with Google Apps, heavily used by education, municipal and other governments, and of course corporate users.

Here was my first thought: "Wow, google is collecting mobile numbers for a ton of people".

Granted, they can't just start blasting SMS messages to users (unless it's security/account related) but just the fact that it can ethically make the connection between the mobile number (and carrier and physical location, etc) and the Google account (which could include Gmail, Adwords, Adsense, Photos, latitude, Reader, and more, etc) is an advantage that few companies can get.  I'm pretty sure Facebook could implement a similar system (unless they already have?) and it would not be a problem, considering 50% of users are already accessing the Facebook from their phone already.

We hear a lot about how our mobile device is becoming more and more like our 'Passport'.  It seems that it's also creeping towards replacing our wallet.  One thing that concerns me a little is the recovery. What if I drop my phone in the lake?

What if I'm an executive and have been for 20 years.  My company email and my company phone are mine.  I go to the trouble of verifying with all these new-fangled procedures, only to be packaged out next month...  Then Google wants to verify something because I'm in a new city with a new computer--- and I can't because I don't control that phone or number anymore?  What's the point of having it, if I can just tell google it's different now?  

Oh-- I forgot, my mother's maiden name will solve that problem.