Interesting example. I was thinking about this more in the direction of "protecting the IP/investment" rather then "abuse the users" but i get your point.

With the telegram example, i don't see it very much different from a SaaS where you get to talk to an API however you want. My question was more in the space where the customer gets the entire codebase (to deploy it themselves) where just the core is closed (or proprietary with maybe source available)

would seeing the source for the core (but no rights to alter/reuse) improve your opinion as to "doing some scam"?