Thence, for securing your webhook you have only two option:
Allow requests only from Telegram subnets. The are fixed in documentation, but may change in future.
Use secret value in endpoint address, e.g. /telegram-webhook/468e95826f224a60a4e9355ab76e0875. It will complicate the brute force attack and you can easily change it if the value was compromised.
This little plugin allows you to use both ways to secure.