Nobody really knows except from a few security researchers? I'm not working at Apple and I can't access the device internals. You can't build a third-party iMessage yourself unlike on Android anyways so there's some system apis somewhere enabling that for sure.
There's at least some special security keys, a custom notification system, extended access to device storage and custom wakeup exceptions from what I could deduce myself looking at it. Of course there's for sure more than that but that's at least what's visible.
Go ahead and prove me wrong then, link me an alternative iMessage client built with the normal apis or even explain how you could even do it. Good luck.
I can do that on Android, that's impossible on iOS because it's a custom system app with custom apis.