Is it possible that the file downloaded at registration would come as an attachment in the letter to the administrator?

Nope. Just be sure the field is accessible on the users profile. Alternative is move it to a tab that's on a not shown on profile tab position (this allows the substitutions to work, but hide the field from profile view) and use the raw substitution of [FIELD_NAME] and it should just be the URL to access the file directly.

One option is to purchase and use CB Privacy and force the fields privacy to Private, which allows the profile owner and moderators only to see the field. This can also be done for entire tabs.

Alternatively you can use the Layout parameters and substitutions to determine who can see the fields values. See the below substitution tutorial for substitution usage information.

www.joomlapolis.com/documentation/279-community-builder/tutorials/18353-using-substitutions-throughout-cb

You'd basically set the Profile Value Layout under Parameters > Layout within your field to something like the below.

[cb:if user="#me" viewaccesslevel includes "##"][value][/cb:if]

Replace ## with your CB Moderator view access level id found in Users > Access Levels. This should display the fields value only to those users. This can be expanded on further using AND/OR cases as well as elseif and else cases as shown in the tutorial above.

If you're adding it to an email sent as part of the registration workflows ensure you've enabled support for HTML in those emails within CB > Configuration > Registration otherwise you need to be more specific as to which email is giving you problems.