GSM is not secure and OTP via SMS is not secure - this is a vulnerability of many many systems, including banks and Bitcoin vendors. This has nothing to with Telegram's crypto.
Just because others are also vulnerable to the same failings doesn't absolve Telegram of responsibility. Don't claim to be a secure platform if your security is easily circumvented.
Also by default Telegram sends confirmation messages to previously verified clients instead of by sms.