That's a better MCU, but aren't they using a secure element to store keys?

Right. Why not add a ATECC608A?

ATECC608A is nice but can't provide total key isolation with the key derivation method most U2F keys use. E.g. it calculates the key using an HMAC, it gets sent back to MCU, the MCU writes it as a private key back to the ATECC608A to be used for signature. Also the ATECC608A requires an NDA.

Given this, I think having a 1 chip solution really simplifies the design and allows more flexibility.