[can16358p]

The transport is secure, but if an attacker has already found their way into the device, they can intercept notifications/iMessages and remove it automatically anyway, so yes it's a bit or concern. But at that point, anything will be concerning, not only iMessage.

[londons_explore]

Send all the notifications at once without warning, and the real recipient will probably see it before the attacker programs his malware to hide this specific notification.

Obviously, that only really works once.