A phone number is only one of several options to receive a verification code if you use two factor authentication. If you have another device signed into your account it can receive a verification code and then you can sign in securely and edit that old telephone number.
Based on: Get a verification code and sign in with two-factor authentication - Apple Support :
A code is sent first to your trusted devices automatically. If you have a trusted device running iOS 9 and later, OS X El Capitan and later, iPadOS 13 and later, or watchOS 6 and later, the verification code is displayed automatically on your trusted devices.
If you don’t have a trusted device handy, you can choose to have a verification code sent to your trusted phone number as a text message or phone call.
1. Select “Didn’t Get a Code?” or “Can’t get to your devices?” on the verification code screen.
2. Choose to have the code sent to your trusted phone number.
3. You'll get a text message or phone call from Apple with your verification code. This text message might include an additional domain validation line. This line includes the @ symbol, the website name, and your code (for example: @icloud.com #123456 %apple.com).
4. Enter the code on your other device to complete sign in.
If you can’t sign in, reset your password, or receive verification codes, you can request account recovery to regain access to your account [ How to use account recovery when you can’t reset your Apple Account password - Apple Support ]. Account recovery might take a few days or longer, depending on the specific account information you can provide to verify your identity.
