Why doesn CPE just use a numeric naming convention similar to CVE and CCE?
In short the answer to this question is to support matching. CPE is often used to identify the platform type of a given machine and then to have that type compared against applicable types of different issues (e.g. like vulnerabilities or configuration statements). In this use case, the level of granularity that the identification is made is often different than the level of granularity that the applicability statement is made. To resolve this, there must be a way to understand relationships between different CPE Names. For example, a system might be identified as Windows XP Service Pack 2, but a vulnerability is said to apply to Windows XP. Through matching, we can deduce that a system identified as Windows XP Service Pack 2 is also a Windows XP system, and therefore the vulnerability applies.
