If a MAC is encrypted using CTR specifically then specific bits can still be flipped by an attacker. So although the MAC isn't known, specific bits can still be altered in transit. This may allow certain attacks, depending on the error handling of the receiver of the protected messages.
[The question I cannot readily answer is if such a small authentication tag gains nothing from being encrypted. Please alter.]
A CMAC should indeed already be secure by itself. Encryption of a MAC should not be necessary.
In the protocol you are describing the CMAC is however truncated to a very low number of bits. Look at this snippet from RFC 4493, section 2.4:
It is possible to truncate the MAC. According to [NIST-CMAC], at
least a 64-bit MAC should be used as protection against guessing
attacks. The result of truncation should be taken in most
significant bits first order.
No, it's not a "typical approach" in the sense that newer protocols usually calculate an authentication tag over the ciphertext instead of the plaintext.
There are however protocols where MAC-then-encrypt is used, notably Transport Layer Security (TLS). This actually opens up TLS to some attacks such as the Lucky Thirteen attack, although that attack also requires CBC mode encryption instead of CTR mode encryption.