If someone were trying to game the system and get lots of local listings without having a physical presence, using a central call-in number would probably be the easiest way to go about it. Google could figure this out either from just thinking about it, or from experience.
So, the next step of difficulty would be to require postcard verification, where the business had to have some sort of addresses in all the cities claimed.
If people start using mail drop addresses, and chances are that many have, Google might take measures to filter those out.
While the verification process adds an extra step for a legitimate business, it also offers some measure of protection against competition that's not really local. If I were a legitimate business with many locations, I would view the verification process in that light.
I'd make some effort that all my addresses were carefully and accurately listed, and that someone in the mailroom at each location was aware that a verification mail might be coming. I would think, for some companies, that postcard verification would in fact be easier than telephone verification.
From Google's point of view also, they may not want to pay their employees for the time it takes to wade through the telephone branching menus that many large companies have.