Yeah, this is basically how it goes. Telegram is set by default to allow anybody to add you to chats. You can disable that, or set it so only Contacts can add you. Anyways, how it usually goes is some nefarious party, or a bot, will make their way into a legit chat room and then start adding all the members to their crypto chats, or whatever. Thankfully, I only ever was added to crypto scam chats at random before I fixed my privacy settings.