As of Safari 18.3 (macOS, iOS, iPadOS), authenticatorAttachment still set to platform instead of cross-platform when registering a credential using a security key (usb/nfc transport) or mobile phone (hybrid transport).