Telegram has an open-source client and is moving to verifiable builds (not on every platform). You cannot hide such a backdoor, and users would be able to recompile a clean version of the app.