Bridge has multiple personalities (and the distinction between them in ROS configuration is not made at all). One of personalities is a “CPU-facing switch port” (and by “switch” I’m referring to bridge’s switch-like functionality).
Have a look at this excellent explanation, I believe it’ll clear the mental picture you’ve got. BTW, the way @steveocee mentions it is not exactly right. Bridge doesn’t have to be tagged (or set with PVID for that matter) with some VLAN for that VLAN to between member ports, port properties (and VLAN properties) govern it.