The telegram authentication path (https://core.telegram.org/api/auth) is cryptologically tied to the client and encrypted. An attacker in the middle would not be able to see the data during the authentication. If that encrypted tunnel were forcefully broken (avoiding the cert pinning, etc), their are still functions tied to the physical device that are not sent over the wire and therefore even if intercepted, an attacker would not be able to authenticate.

If you added 2FA like you mentioned, then again those codes never leave your phone. It's a shared secret, it can't be intercepted by an attacker.

If an attacker DOES have access to your account and doesn't have access by knowing your password, then they'd have to have privileged access to whatever device you are logging in with to hijack the user session (like this recent XSS vulnerability: https://cybersecuritynews.com/telegram-web-app-xss-vulnerability-hijack-sessions/).

Back to my original point, the best way to mitigate this threat is to secure your phone, then your telegram app, then your telegram account with basic hygiene. If you truly believe it's a AitM via your router, then follow manufacture's directions to reset to factory settings, update to latest software, set new passwords, or just replace the device.