The main reason you can’t just CNAME to any Cloudflare subdomain (workers.dev or not) is that doing so would require Cloudflare to set up an IP address specifically tailored to handling that worker but with any incoming SNI/HOST header. Without a special IP, the incoming request just looks like any other regular Cloudflare request, since CNAMEs just alias IP addresses and don’t instruct the client to do something like request the CNAME target but instead display the content as the original hostname.
As for hitting the CF cache first, the Workers technical lead himself explained why you can’t just cache in front of the worker to get cheaper Workers pricing: