I disagree, who says there isn't a bug with Heartbleed-like severity in their crypto? You could flip your argument around and say the fact it took so long for

I disagree, who says there isn't a bug with Heartbleed-like severity in their crypto? You could flip your argument around and say the fact it took so long for Heartbleed to have been discovered means even OpenSSL didn't have enough people checking it. Which it probably didn't. And Telegram has even less people combing through its source than OpenSSL did pre-Heartbleed. The only valid reason I can think of is a small and obscure proprietary crypto algorithm and implementation isn't worth the bad guys/agencies' time for finding the inevitable bugs. But Telegram has gained more than enough popularity for that ship to have sailed months ago.