This isn't exactly correct. The bridge terminates the service encryption then applies matrix encryption (if used). So there's a moment where the messages exist in an unencrypted state, but that's not the same as bridge -> client being unencrypted.

So yes unencrypted state exists at the bridge for a period of time, but it's not perpetually unencrypted.