I was reading the Hybrid Public Key Encryption (HPKE) RFC and I came across this sentence in section 9.4 "All AEADs MUST be IND-CCA2-secure, as is currently true for all AEADs listed in Section 7.3."
My first thought is that AE (Authenticated Encryption) implies IND-CCA2 by definition ("Introduction to Modern Cryptography" by Katz and Lindell: "A private-key encryption scheme is an authenticated encryption (AE) scheme if it is CCA-secure and unforgeable") and this is the commonly accepted definition of "AE(AD) security".
So where is the catch? I presume the authors of the RFC have a different interpretation of what is an "AEAD scheme" since my interpretation is "it is AE-secure according to the definition". I googled a bit and found a few papers also discussing stuff like "IND-CCA secure AEAD" so I assume there is something wrong with my understanding of "AE(AD) schemes". Do they just mean that the algorithm has the "AEAD interface", i.e. input to encryption function is (key, nonce, AD, plaintext), and it does not make any claims about security?