It probably would've been using the bridge's HTTP API. You likely authenticated by pushing the button on the bridge.

The lightbulbs themselves only have a Zigbee radio (and Bluetooth, but not in 2018). They communicate with the LAN via the wired bridge.

https://developers.meethue.com/develop/get-started-2/#