Why is Fernet only AES-128-CBC? I have a communication system that's currently encrypted using AES-256-CBC. Someone on Information Security StackExchange asked whether I'm using HMAC, so I'm looking into Fernet.

Fernet seems to use AES-128-CBC (link). This seems to me to be a) less secure than what I'm using and b) not sufficient to meet the requirements of some sensitive companies/entities that require AES-192 or AES-256.

Is this a problem? How should I decide whether to stick with my current approach or HMAC w/AES-128-CBC through Fernet?
This seems to me to be less secure...

Do you have a plausible adversary that can break AES-128?  AES-128 is believed (to the best of knowledge) to require $O(2^{128})$ operations (unless someone has a Quantum Computer, in which can it takes $O(2^{64})$ Quantum operations, which might not be any more practical).  For a reference, if an attacker has designed a chip with 1 million cores, and each core can test 1 billion keys per second, and he has 1 billion such chips, it'll still expected to take 4 million years before he happens to stumble across the correct key.  Do you have an adversary who can devote considerably more resources to this task than my rather extreme example?

And, if AES-128 is secure from any plausible adversary you can have, how can you say it is 'less secure'?

In addition, if you're not using some sort of MAC, that means that you are open to adversaries who can modify your data; attackers can cause all sorts of mischief (including deducing the decryption in some cases) by doing that.  That is a practical concern; IMHO, it far outweighs any concern about Space Aliens who could break AES-128.

Now, I have not reviewed Fernet; it could be that they got some details wrong (such as not selecting IVs correctly).  However, we know there are issues if you don't do integrity checking on your ciphertext.