In short: The per message AES key is derived from the contacts public RSA key.

Erm that's not how it actually works. Though in your defence, "in short" is pretty hard to achieve here.

The real headache though isn't encrypting the messages. It's making sure that only the intended recipient has the decryption key for your message. That's where E2EE messaging gets complex and frankly Apple doesn't do the best job.

It's theoretically possible with iMessage, especially in a nation state level attack, for a compromised device to be one of the recipients your encrypted message is sent to. Wether "theoretically" is "actually in practice" happening is hard to judge, because nation state attacks are normally hidden by court mandated disclosure suppression orders.

The way Signal is architected, it wouldn't be possible to comply with a court order like that. Unfortunately that means some Signal based messaging services will be forced to exit the UK since laws coming into effect next year will give them no other choice. It'll be interesting to see if signal based services (like Google RCS) also walk or will they weaken their encryption in order to be able to comply.

The fact at least one nation state is passing laws that force "encrypted" messaging services to have the vulnerability that iMessage has is a pretty strong smoke signal that attacks like that are happening....