This is absolutely a failure I Telegram for not recognising APK as malicious.

But Telegram does not have permission to install apps. For this to work the user must perform not one but two stupid things.