The whole article is based on the fact that secret chats are not enabled by default. But i dont understand why that's a critical point, if you are so worried about privacy just start a secret chat. Also from what i can understand its a design decision telegram took. If the secret chats are always on then the private key needs to be transfered from device to device and on new devices,which is a security risk.

The points about the contacts is right though. Also i am a strict no for closed-source privacy app. Even though telegrams code is open, the repo is handedly very badly. With squashed commits pushed once in few months, issues disabled.