It looks very bad that Telegram took almost 3 months to fix this vulnerability.

Reported 25 June

Fixed 16 September

I wonder why it took them so long?

It was reported to a third party platform which the author says is likely clogged up.

[deleted]

They are restructuring their companies regularly and keep the core company small.