I'd like to see a more comprehensive test to prove that the messages are part of the backup. Since you have to sign in to iMessage, it's possible that these are being retrieved from the iMessage server in an encrypted form - "I restored an iPhone and saw old messages" is not proof that they are stored in plaintext.

Also.. it's important to note that the iMessage client only retains about a day's worth of messages on the device. Earlier messages can be obtained via a "load earlier messages" button. This means that Apple does store the message history on the iMessage servers, and there is a way for the client to retrieve them in batches while the contents are not accessible to Apple.

It seems extremely likely that this 'iCloud Backup' vulnerability is a red herring. The messages are not stored in the regular backup but are fetched encrypted by the client when you sign in.