Yes, and there are many ways for apps to opt into this, to limit their own blast radius in a case like this.

Does Telegram do that, or do they consider themselves beyond bugs, just like they consider themselves too clever and untouchable by anyone to need end-to-end encryption?