All this could have been avoided, had Telegram published the blog first. It's a common problem of companies not owning the vulnerabilities found in them and its understandable that they get scared owning them. But when it eventually comes out, they should talk like "yeah, there was silly xss not a big deal as the author said it to be, but yeah its there". That's it. There is no need to say "researcher wants PR" and "researcher is irresponsible".