Damn. In that case, the email address or at least the domain appears to be legit. I think you might want to wait until
@legalfalcon or someone like that advises. It does seem very odd to me that cbsa would contact you directly. Defeats the purpose of the security check, imo, to contact an applicant directly. I wonder if ircc call centre agents would be able to see in your gcms whether you were contacted by cbsa or not. But since they are an independent body, probably not? Sorry, I'm no help. Keep us posted on this.
EDIT: Just re-read your original post. If they asked you to update your IRCC portal, this should be fine. How about you call IRCC using Textnow and tell the agent about this. Ask them if they can go into your application and see a record of cbsa attempting to contact you (although I doubt they will be able to see, it's an independent body). You can nevertheless update your number with IRCC. If it is really cbsa, they ought to be able to pull your updated number via ircc's portal.
Also, if you search the forum, it appears that CBSA does sometimes call applicants.