sudo du -sh ~/Library/Messages
    Password:
    du: /Users/cvaske/Library/Messages: Operation not permitted

Edit: investigating a bit more, apparently the lack of a sudo-equivalent, an "elevate this one process temporarily" command is intentional in the design, so that malicious scripts can't take advantage of that "this is really the user" approval path. I can't say I agree with that design decision, but at least it's an ethos.