On the other hand, they have been audited [1], have transparency reports [2] and their servers are Swiss based [3]. Yes open source would be nice, but a relative small company with a focused business model (not dependent on advertisement, data-gathering, donations, kind [bi|mi]llionairs) has its advantages too.
I'm using Threema since some years and wouldn't want anything else.
[1]: https://threema.ch/en/faq/code_audit/ [2]: https://threema.ch/en/transparencyreport [3]: https://en.wikipedia.org/wiki/Threema#Privacy
So is Crypto AG. Didn't help Iran from keeping secrets from the NSA: https://en.wikipedia.org/wiki/Crypto_AG
[edit to add: not saying that Threema sells out like this, but "they're Swiss" is as meaningless for a security assessment as any other nationality]
which doesn't mean anything.
There are certainly other options, but I think Switzerland is among the countries with quite reasonable data protection laws. Here the text... https://www.admin.ch/opc/en/classified-compilation/19920153/...) or some statements which I found with a quick google search: https://protonmail.com/blog/switzerland/ or https://swissmade.host/en/data-protection.
Also, Telegram isn't that open source either: server side is closed source and the client side seems to be still an undocumented, mirrored mess.
So for me at least, as I don't want anyone that easily to read my messages: many other solutions > WhatsApp > Telegram.
Telegram is not perfect but better than WhatsApp. Also there is people who want convenience like history sync - it won't help telling them that it's unsecure. In the end at least facebook doesn't have their data.
For NSA etc. it's not that important where stuff is. From the leaks we know they can do everything they want (expertise + huge money) so if you want something more secure you maybe shouldn't use one of the popular solutions at all ;-)