If you're talking about the lack of support for binary responses, I don't think this'd stop people from using Base64 to tunnel arbitrary payloads? Otherwise I'm not sure what the alternative would be to "passing the URL in cleartext" to an HTTP client.

No I meant you must use an API that accepts URL and cannot create SSL sockets and hide communication from Telegram.