There's a lot of bad news about CDC devices as well:

• CDC devices need your end users to install a device driver, and they get to see that scary message we just showed you that makes them want to call you for help.
• CDC devices need you to write a protocol: what the two sides are going to say, so there are opportunities to get things wrong here. (Hopefully your old legacy PC code has been debugged years ago, right?) 
• The process of turning your USB connection into something that looks like an ancient RS-232 port essentially does a "frontal lobotomy" on all of the extra intelligence that was designed into USB in the first place.  You are left with something that is no smarter than an old, dumb serial port:
• No way to tell who made the device at the other end of the cable
• Not way to tell if there is anything at all at the other end of the cable, except by trying to send some data to it and hoping that you don't mess up the device in the process 
• Those Virtual COM port numbers actually move around. Even if you never disconnect your CDC device, and always leave its cable connected to the same USB port on the PC, your PC software that is expecting your device to be on COM6 will find that it isn't there some days.  You will actually have to write code to search through COM ports to find your device.  (Wasn't USB supposed to be smarter than that? Oh yeah, it was...)