What Apple says about what they do in the US, and what they do in China, are two different things. And what Tim Cook reaffirmed is irrelevant, what matters is how the iMessage protocol works.
As far as I can tell, the way iMessage works according to Apple's documentation, is that endpoints generate 1280-bit RSA encryption keys, hold the private keys on the device, but publish the public keys to a centralized IDS Directory Server. Note that their published security documents curiously don't say anything about man-in-the-middle mitigation, and indeed, MITM attacks against iMessage on IOS9 were publicly documented.
Now, what do you know about where the IDS servers are located in China, and who controls them? Because if Apple doesn't control them, and control them in a way that makes them impossible to spoof, then it is easy for the Chinese government to attack iMessage.
Thus, Tim Cook could say "We haven't put any backdoors into iMessage for the Chinese government and it is end to end encrypted" and it would be a true statement, but also Apple engineers could know full well the IDS in China could be subject to a MITM.
A plausible way this could happen, after Apple moved the iCloud keys to China, is that the Chinese government could request to intercept communications from a particular user, and the public keys of every recipient that user communicates with could be replaced with a MITM key so they can rely the messages and see the unencrypted content.
We don't know, but what we do know is that iMessage has been attacked with MITM before, and we know the PRC isn't going to let unbreakable encryption be sold to Uighurs in Xinjiang. It defies logic.