I find it hard to believe that Telegram did not respond to the author. How can one company simultaneously host a $200k security contest, yet not respond to a simple email disclosing a vulnerability?
There's literally no way to defend against this attack. About the best they could do is show a warning like "Warning: The version of Android you are using contains vulnerabilities attackers could use to take control of your phone. Please update your softw... buy a new phone to get the latest version of Android."
It is unsurprising that text can be found unencrypted in memory---even while during rendering it has to be decrypted somewhere.
The only mildly surprising/troubling thing was unencrypted data stored in the file one disk on the phone.