The dude you just shook hand with might have had a glove and stole your finger prints. The post employee you just gave your check to mail might be a impostor. The guy you're about to meet from craigslist might steal your iPhone and cut your thumb to access your entire digital life.
Ah but no, you're an average Joe and nobody gives a flying fuck about any of these.
Even if the software is totally open-source: unless you also made the hardware: it doesn't matter, unless you compiled all of it (and at that point probably wrote the compiler yourself as well as the os you're using) and installed yourself: it doesn't matter, unless you actually went though every single line of code and checked for yourself that every thing is safe (which you cannot): it doesn't matter
but in seriousness, it doesn't need to be the OS itself of course, just any software that runs on the OS
> Every operating system now phones home and uploads copious event logs.
There is nothing about telegram in there.
For awhile Canonical had a deal with Amazon that was highly questionable. https://www.gnu.org/philosophy/ubuntu-spyware.en.html
The most dangerous however is the auto-updates. Even if the software is safe today, how do you know what tomorrow's auto-update will bring?