Hacker News Reader

If someone is able to authenticate as your phone number, they can set up iMessage and receive a copy of your future messages.

Wouldn't they need to at least need to log in with your iCloud credentials?

nope iMessage does not require iCloud

This is wrong. iMessage uses your Apple ID and is definitely iCloud based. That's how it can tell the state of messages from device to device.