It's even worse that that. As of about a year ago, iMessage didn't do any certificate pinning: http://blog.quarkslab.com/imessage-privacy.html

Unless that's been fixed (I haven't come across any evidence one way or the other), you're not just worrying about Apple and the NSA: Your iMessages are vulnerable to anyone who can forge a certificate and MITM your connection to Apple's servers. I'd say that's a reasonably high bar except for one thing: I believe it covers the vast majority of corporate iPhones used on company-internal networks.