Links in Telegram have been opening random apps (image viewer, Calibre, etc), so I checked System Settings > Applications > Default Applications > Web Browser.
Open URLs "in an application based on the contents of the URL" sounds like the culprit, so I changed to "in the following application (Firefox)".
However after leaving this screen or rebooting (both) the setting reverts:
I ran system settings from console, but I couldn't see any obvious errors.
Update: I ran a fresh install of Kubuntu 18.04 in a virtual machine and tried this, with the same result. Did all available updates and rebooted, tried it again – same result – even though it was on a fresh, stock system.