I never found signal lacking in any way, except that occasionally push notifications don’t get through. When people say signal is lacking in features, what do they mean? Simplicity is appealing too
It seems hard to add a rogue device to an existing user's account without them knowing. The 5-digit login code is sent by SMS only when there is no other devices logged into Telegram in the account. In all other cases the user will be notified by seeing the confirmation code message on their Telegram app.
One can add a password as an authentication factor for their Telegram account also. Just in case the login code is intercepted.