How would you behave when someone finds hard to exploit XSS in rarely used Web client and tries to hype out yet another "completely hacked" story? I would have same annoyed tone too.

All this could have been avoided, had Telegram published the blog first. It's a common problem of companies not owning the vulnerabilities found in them and its understandable that they get scared owning them. But when it eventually comes out, they should talk like "yeah, there was silly xss not a big deal as the author said it to be, but yeah its there". That's it. There is no need to say "researcher wants PR" and "researcher is irresponsible".