As @Lucius (+1) has said very well, those wallets in which the users do not control the private keys are not really ours, that's the first thing any user approaching cryptocurrencies for the first time should learn. Any wallet (especially hardware wallets) is much more secure than wallets that "depend" on some type of service, like Telegram in this case, even software wallets in which we control the private keys. Your friend has learned a hard lesson.
However, it should be emphasized that even non-custodial wallets can be potentially dangerous, so they should not be trusted blindly. A good example is the popular Ledger, which was always known as an example of a safe and reliable hardware wallet until a major database hack occurred, which caused major problems for most of their users, and then they introduced the Seed Recovery service, which, if approved, divides our backup into three parts and sent to three different
"addresses". The very fact that the seed can be extracted from the device (remotely) brought a lot of distrust in the company, especially because they claimed all the time that it was not possible.
I think the most important part when using a Telegram wallet is that you don’t put too much on it that you are not willing to risk losing because you could just put it in a hardware wallet where it is safer. Make sure that your number is always updated and no one has access to it so you can be sure that it is only you who have control.
In that case, there is another danger called SIM swap, which would mean that someone who is marked as a target can become a victim of such an attack. In some countries, all you need to get a new SIM card is to go to your operator's point of sale and tell your mobile phone number.