How to disable Firebase Phone Auth Android auto-sign-in (onVerificationCompleted callback)
Update, 11.5.09 should have reached almost all users' devices. Instant validation will be stopped after a SIM card change. And you can also use this trick for manual testing purpose.
In an upcoming Google Play services v11.5 release scheduled for late Q3, SIM card change will be auto-detected which will stop instant validation from working. The new release will be auto-pushed to users' devices and no SDK change is required.
To get the best UX and opt-in rate, it's better to wait for the Play services update rather than adding the scary runtime permission yourself (to read and compare phone number). Thanks for your patience!
Unfortunately it seems that there isn't a way to disable Instant Verification at the moment.
After asking the devs to add this feature (actually for a different reason), I was replied that it will be added to the feature request.
Perhaps you should add a comment there too, specifying your security findings. Maybe it will speed up the process of adding this feature :)