https://blog.cryptographyengineering.com/2024/08/25/telegram...
Ultimately the only way to be completely sure is to use an open-source app like Signal that you've either built yourself from source you've inspected; or sourced pre-built from someone you trust.
Big Five of other hand (UK, USA, AUSTRALIA etc) spy network are already working with your western government...
So I would rather be compromised in Russia with 0 chance of extradition there than non 0 to USA, UK GERMANY etc
(Let's say you are producing fake Coco Channel perfumes)
If neither of you have done this, don't worry the client side code is so sloppy there will be a zero click RCE that can steal all your chats anyway.