> I see no reason why open source helps here
Open source doesn't make things automatically secure, but one can't argue that it isn't much easier to inspect.
I really can.
Bytecode is basically the same as source. Decompiled binaries are harder to read, but there are oodles of professionals who are very skilled at reading decompiled code. The actual structure of the program itself plays (to me) a much bigger role in the auditability of a system.
I see no reason why open source helps here. Closed source clients aren't black boxes. You can examine the bytecode. You can decompile the binaries.
I see no reason why a conspiracy dedicated enough to hide a backdoor as a buffer overrun wouldn't also be capable of making the Telegram server store key material in a single country to make it available to legal requests (since, as you say. the back-end software isn't open source).