This also means that it's much easier to spy on someone on Telegram: just create a fake device with telegram, then login the user into it using a phone with fake identity. Easy-peasy for a (Russian) government.
It seems hard to add a rogue device to an existing user's account without them knowing. The 5-digit login code is sent by SMS only when there is no other devices logged into Telegram in the account. In all other cases the user will be notified by seeing the confirmation code message on their Telegram app.
One can add a password as an authentication factor for their Telegram account also. Just in case the login code is intercepted.