The Telegram backend is still closed-source as far as I know. The problem with their crypto is that nobody really knows if it's secure or not because it's closed and unverified.
Ever heard the first rule of encryption? "Never roll your own crypto". Well they broke the rule and they won't let anyone check if the crypto is secure or not.
Not to mention encryption is off by default and your plaintext messages are stored on their servers...
