Yup exactly, their home rolled encryption is problematic in and of itself, but the fact that it lacks E2EE means you shouldn’t even trust it in the first place.

They do publish https://telegram.org/blog/tdlib so couldn't a client author just do shared key encryption or something?

Also opposite in terms of feature-richness.