I was unclear on that as well. WebAuthn uses an extended form of the U2F format, such that if you don't use any of the new features or extensions the two are binary compatible with compatible signatures.

So the U2F bits like authenticator data are in a bespoke format using section lengths, while the newer features and extensions are CBOR.

One could translate the bespoke bits to CBOR, but care would be needed if you want to round-trip back to the bespoke format (e.g. so that attestations could be verified in the future off of the registration record.) Since CBOR isn't really as usable as say JSON as being an abstract object access API, and since CBOR is going to take up more space, I don't think this would really provide value over leaving it in the WebAuthn format for tooling to work on directly.