First I thought that Telegram makes bots available online for users without Telegram, but it seems that they only have added a webview to Telegram.
Apps would get user's IP address and device details. Definitely bad for privacy-obsessed folks.
This can also be used for social engineering, for masquerading as Telegram interface or system popups to get user's trust. And, of course, for disclosing the identity of users.
Also it might allow intentionally crashing Telegram by allocating too much memory.
This is pretty cool, but it’s just another walled garden. No thanks.