Did a bunch more research on this by researching the cdc-acm, the usbmon function and the USB specification.
It looks like the bulk channels being the dropoff/entry points for serial data was a flawed assumption.
I won't rehash everything here, but if I were to do this again:
The cdc_acm driver is a bit more involved than I realized and there are numerous exception cases to work around flawed/differing implementations.
I ended up using the i2c-tiny-usb driver as my basis. I uploaded the Arduino i2c_tiny_usb_adapter example to my Seeeduino Xiao, connected, then offered it as an example. I then used i2cdetect to run a scan.
I used usbmon to monitor traffic of that scan. That way I could reconstruct what was "really" going on.
The USB Spec indicates every device has an endpoint 0 control interface which configure the device. For simple implementations, such as I2C, you can just get/request data via that interface.