This is not a bug. The entry created and updated dates in the database use UTC, while the dates in the CSV export have been modified to align with the timezone set in the site’s WordPress settings.
The GFAPI also returns the entries using UTC dates. You can use the following to adjust them to the site timezone.
$date = GFCommon::format_date( $date, false, 'Y/m/d' )