This isn’t a zero day nor does it really seem like Telegram’s fault, this is just how android itself works by design and this would likely affect any app that didn’t have specialized logic to recognize a malformed apk file. If an app tells android “open this file” it’s going to search for something that can read it, in the case of something with an apk manifest that becomes the system installer.
It’s still very unlikely to happen since android will warn you and you have to go through several dialogs to enable installing the apk.
This will be an unpopular opinion, and I’m not saying their argument is correct, or that the good doesn’t outweigh the risk - but this is exactly what Apple was talking about when they explained why they don’t want side loading.