[Polylactic_acid]

That theory is quite possible. If the police join the group, they know the usernames of all of the people in the group, they can then start adding numbers to their contacts and if any of the usernames from the group show up they can then look up who owns the phone number in the government database.

[PlasticTank]

It surprises me that they don't require both of you to have each others phone numbers in your contacts lists before giving away identifiable information.

[newscracker]

Telegram released a new version with that exact same requirement to enable visibility. The settings in Telegram have also been expanded for this. On the other hand, this same vulnerability exists (and continues to exist) in WhatsApp and Signal.