Bitwarden does some of the KDF operations server-side which means that a portion of the password (even if it's been through some KDF operations) is sent to the server.
EDIT: https://palant.info/2023/01/23/bitwarden-design-flaw-server-...
EDIT: https://palant.info/2023/01/23/bitwarden-design-flaw-server-...
What that article is saying (rightfully, mind you) is that an attacker can mostly ignore the server side round of encryption, because if they have a copy of your local vault, they can just perform the client side rounds and then see if they can decrypt the vault.
This is a problem mostly if you see their claims of 100000 rounds server side, and decide "oh that's fast enough, I'll drop the client side rounds to 5 so my vault is fast to open)"