Regular reminder that Signal has had 0 messages ever provably decrypted and that Telegram has had 0 messages provably decrypted. All of the MTproto weaknesses are theoretical and have 0 working proof of concept attacks.
That was not theoretical at all, and very much something that could be used without detection, even if the users verified fingerprints, since it made clients create insecure keys.
The guy who found it got their maximum bounty IIRC.
Whereas the best attack on signal was somewhat sort of relay thing of very questionable usability to an attacker.
It could have been done by Telegram. No proof it was. Still sound theoretical to me. I doubt they knew it was possible.
Also: Was Telegram's source used to find the vulnability? If so, it's unfair to compare WhatsApp and Telegram like that.
Also WhatsApp doesn't bait with a bounty like Telegram does (see https://www.linkedin.com/pulse/whatsapp-security-vulnerabili... for example).
I don't know which one is worse.
There is also a pretty substantial branch of the computer security industry that thrives on security problems found in software they don't have the source code of. And good luck keeping up reviewing telegram. They release sources every 6 months. Last one was for 3.18 which had something like 170k additions and 90k deletions.