I often find myself a little unsure of when to use a number input, but Kilian has put together a detailed (yet brief) overview of exactly when it is (and isn't) appropriate. The tl;dr is beautifully summed up as:

If you're dealing with an identifier that just happens to use digits, or a number that represents something completely different once you increment or decrement it by one then you want a regular old text input, not a number input.

That means things like credit cards, passport or ID numbers, or 2FA codes are better to be used with text inputs. Still want the nice numeric keyword on operating systems that support it? Use inputmode=numeric instead.

Of course, there are still times that number inputs are valid. As Kilian mentions, one key use case is for improved validation and refinement of options within numeric ranges and with specific steps:

Secondly they let you use built-in validation logic like input.checkValidity(), and that will make sure that the value is indeed numerical, within the given bounds, and matching to any step you specified.