Yeah, that still doesn't make sense, as WPA2 should be fine... at least one would think...
You don't have any of the non-standard WiFi extensions enabled, do you?
Something to note - in both 11ac and 11n, the uplink and downlink MCS rates are negotiated - it's usually based on the SNR of the AP Beacon frames, along with the Probes on the Client side, during the attach, and then dynamically adjusted over time based on frame error rates - and there, the rate adaptation methods on the client side determine the best rates.
Another thing, and I'm not sure anyone has pointed this out - the AC66U-B1 is pretty old, and it's an early 802.11ac Wave 1 chipset, just something to consider, the performance you see might be as good as it gets with this device in Wireless Bridge Mode... the core CPU there is a single core MIPS 74K at 600Mhz, and the radios, while 3*3:3, they are first gen WiFI5/11ac - there's been a lot of improvements over the years.