How is that possible if iCloud is also purportedly end-to-end encrypted [1]. Specifically, this page says "No one else, not even Apple, can access end-to-end encrypted information."
Another possibility is through the course of employment, the employee installs the internal dev version of an app and had to explicitly grant trust to it. [2] So even if the backup option is not used, the internal version of a messaging app could drop a second copy of messages to a database for audit purposes if needed later. It can be easy to forget that the messaging app you are using isn't the public version.
In short, this really shouldn't be surprising when working in a corporate environment that may have the privilege and/or obligation to monitor employee communications. The key takeaway is never use a business device for personal communications. If you granted your employer privileges to your device through a method like one of the ones above, consider that device compromised unless you factory reset it. If you are in a situation where the employer is requiring MDM and/or trust, then they should be buying you a separate phone for business purposes.
[1] https://support.apple.com/guide/deployment/intro-to-apple-pl...
"For Messages in iCloud, if you have iCloud Backup turned on, your backup includes a copy of the key protecting your messages. This ensures you can recover your messages if you lose access to your Keychain and your trusted devices. When you turn off iCloud Backup, a new key is generated on your device to protect future messages and isn't stored by Apple."
The key to iMessage backup is stored in iCloud for convenience for the end-user. The password has to be stored somewhere. Other e2e messengers usually don't have message backup or have only manual message backup where you are responsible for not loosing the key.
Apple is not able to access iMessage if you don't enable iCloud backup for iMessage.
If you disable "Messages in iCloud" but enable "iCloud Backup", then messages will be included directly in the backup, no separate key needed.
If both are enabled, then messages are in a different cloud "bucket" than the backup but now will be readable with a key stored in the backup.
So it's "iCloud Backup" specifically that needs to be disabled; simply disabling the Messages switch under iCloud doesn't affect this case.
1. the "loophole" is a trade-off between usability and security. Making icloud backups end-to-end-encrypted (ie. you manage the keys) would be more secure, but would a usability nighmare. People are terrible at storing/remembering keys. It's very probable that by the time someone needs a backup, they would have forgotten/lost it, making their backups useless
2. is it really an issue that apple "allows" the loophole? Ultimately you need to trust your conversation partner. Even if icloud backups wasn't a thing, there's a dozen other ways your conversation can be compromised by your partner eg. them taking a screenshot, them leaving their phones unlocked, them snitching on you.