If they have $1M to invest, why don't they focus on securing their protocol (i.e. switching to authenticated encryption) and turning encryption on by default?

See http://cs.au.dk/~jakjak/master-thesis.pdf for more on why Telegram isn't secure and you shouldn't trust it (as it is today) for anything requiring privacy.