wrt iMessage, yes, it’s E2EE and the keys are not stored in iCloud if you disable iMessage backup. Granted Apple still owns the keyset gets so, eh, depends on how paranoid you wanna get.
Yep. WhatsApp is better and Signal is better still, but iMessage's level of privacy and security is more than enough for someone who isn't specifically targeted by a nation-state-level actor.