Previously, they did this by effectively having you sign-in to iCloud on a Mac system running in their datacenter. Handing over your iCloud password to a third-party obviously has security implications, even if you trust Beeper wont intentionally abuse it.

Recently, they had a new Beeper-Mini, that instead reversed-engineered the iMessage protocol and spoofed your Android phonenumber as being an Apple device. This allowed you to use iMessage without ever handing over your password to some remote server (although, still handing it over to a third-party application, and trusting it doesn't do something shady).

Beeper, for its part, has claimed this reverse-engineering falls under the protection of allowed exceptions for the purpose of interoperability. Apple has not yet made any legal claim one way or another, and instead just shutdown the method being used to gain access to iMessage from non-Apple devices.