This isn’t exactly correct. The bridge terminates the service encryption then applies matrix encryption (if used). So there’s a moment where the messages exist in an unencrypted state, but that’s not the same as bridge -> client being unencrypted.