It wasn't theoretical in the sense "this could potentially be a problem" as with most crypto vulnerabilities. We don't know that it was performed, but we know t

It wasn't theoretical in the sense "this could potentially be a problem" as with most crypto vulnerabilities. We don't know that it was performed, but we know that the protocol was vulnerable, either because of malice or because their world champion programmers thought it was a good idea to let the server provide the client with entropy to create keys. I don't know which one is worse. There is also a pretty substantial branch of the computer security industry that thrives on security problems found in software they don't have the source code of. And good luck keeping up reviewing telegram. They release sources every 6 months. Last one was for 3.18 which had something like 170k additions and 90k deletions.