I don't like Telegram and don't think it should be considered a "secure messenger" in the sense end-to-end encrypted messengers are, but I don't think there's all that much to learn from basic clientside coding failures like this. All applications have these kinds of bugs.