Imagine if you forgot to update your phone number with your personal bank, and then some random guy was given full access to your account and all of its contents. And even if you dug through the account options and set a 2FA password (normally disabled) he could still just delete your account outright.

Last I checked, that's exactly how Telegram works by default. It's laughable to consider a service tied to a phone number secure.