Exactly yesterday I thought that I got a spam message, it turns out that the sender is a SpaceX fan and a real interesting human, not the crypto-pushing bot that I had suspected at first when I read the greeting "hi".
I don't get that much spam in Telegram either, but this must be an exaggeration. My WhatsApp and Signal accounts get completely zero spam.
Username in telegram is a public identifier that allow anyone to grant the permission to message you.
The other ways to grant this permission are
1. Add contact with phone number (can be disabled in privacy setting)
2. Have a message/forward message somewhere you can see, and the original sender is you. (Identity forward of forwarded message can be disabled in privacy setting)
3. Be in the same group with the target (chat admin can disable member listing)
Notice, this is a one time setup. A account only need to grant this once, and then he can message you at anytime.
On the android client you find this option under privacy. Pretty sure it never hasn't been there
Did you set every option to 'Nobody' or 'My contacts only'?
The only way to do so is to have a username or phone number of recipient. Usernames are searchable if they are "Public Usernames". Phone number could be hidden from anyone.
I don't see how someone can contact somebody on the messenger yet without an ability to.. actually send a message. Sure, there could be an option to block everyone not in the contact list and use some other medium to relay the contact request[0] but most of the time this is useless for messenger.
But of course I have my POV skewed, because I prefer to use services defensively from the start so I had almost no unsolicited messages on Telegram, WhatsApp and Instagram.
[0] Hey, if you interested in $TOPIC contact me on Telegram, @username! But first send a couple of avian carriers with your phone number and username so I could add you to contacts first!