I agree with your logic, though a paranoid person might point out that they don't need access to telegram's servers; access to the app store or to automatic OS updates would be enough.
You agree to the logic based on a false premise that the 3-letter US agencies do not have direct access to Telegram's servers which are located in the US (among other places).
Yeah, me being a backend guy didn’t think of the client side of things.