I think one of the reasoning Telegram is giving is good though. If protesters in HK are using Telegram to communicate and Apple removes it from the App Store then they have no recourse of installing it.

I guess giving a way like in Android where you hide the setting behind a flag in settings and explicitly keep warning the user when they install an app from outside is a decent middle ground.

I am not sure of this but I think recent version of either Android/Pixel do a check on apps even installed from outside for malicious activity.