Nothing stops you from using BSD licensed code.

I thinks it's a security problem if such apps have access to user's phonebook. On Android I always deny apps from accessing my phonebook. Why do they want to know my contacts? They shouldn't!

In case of XMPP your username looks like yourname@someserver.tld. Looks like email. I see no problem here. Random IDs just give you more anonymity. You always have a choice.

Why I don't use Telegram:
It knows my phone number. All this crypto is useless then you are not anonymous.
It's centralized. It's very bad idea to use centralized services because it's a weak point. Use only federated services.

I think it's stupid to talk about privacy and centralized services. Only federation can give use decent privacy level. Like XMPP. XMPP has e2e encryption (OMEMO, PGP, OTR). And serverless solutions like Tox. Although, it's still missing some important functionality. If you have a choice use decentralized services.

I thought he preferred more secure and private ways to communicate.