Well I obviously don’t understand it as well as I thought I did.
I will have to try some things on my RB760iGS to see if it works the way I thought it did when an ASIC is involved. But I have a lot of other things on my plate at this time, and probably won’t be doing that soon.
As long as you don’t have more than one interface defined on the CHR (whether vlan interface or ethernet interface), then the CHR will not be able to route. It seems the bridge “connection” to the CPU may still be needed, because in the case where there is no hardware switch ASIC, even layer 2 traffic needs to be “forwarded” by the CPU via the bridge. So it seems that what @Steveocee said may be true even when there are no vlan interfaces to “connect” to the trunk.
Having the BR1 set to tagged shouldn’t hurt anything, as long as you don’t have vlan interfaces. The traffic will be forwarded by layer 2 to the trunk and the OPNsense device and the traffic will not be routed by the CHR to bypass the OPNsense device. In other words, any intervlan (between vlan) traffic will still have to occur at the OPNsense device, if the routing engine on the MikroTik device has no “connection” to the vlans via a vlan interface. For intervlan routing to happen on the MikroTik device, connections to the “BR1” device, vlan interfaces, and ip addresses applied to the vlan interfaces would all be required, at least that’s my understanding.
So, it seems that if your only question was “why is in needed” is so the MikroTik “CPU” can see the traffic and deal with it, whether that is at layer 2 (bridging between ether1 and ether2) or bridging between ether1 and the trunk link on ether7.
The most surprising thing to me was that ether8 was affected. But the behavior may change when vlan-filtering is enabled or disabled.
I just went back and skimmed First attempt to set VLANs up where @tdk (should have been @tdw) posted this about the need to have BR1 connected to the vlans for the link between the bridge and the vlan interface. Perhaps it is more than that, maybe it is needed for the link to the CPU whether bridging or routing is involved.