I know reusing keys is a bad idea, especially for CBC and CBC-MAC, but the example for why on Wikipedia seemed to use encrypt-and-MAC. It seems obvious that the last block of encryption will be equal to the MAC when used in this way.
If it's instead used in encrypt-then-MAC, wouldn't that be acceptable? Every bit of the MAC would rely on every bit of the ciphertext, preventing chosen ciphertext attacks.
Is there something I missed here?
No, it is not necessarily secure. Here is a simplified example of why not.
Assume one block zero messages are encrypted without padding. The ciphertext is $I||E(I \oplus 0)$. The MAC value is thus $E(E(I) \oplus E(I)) = E(0)$. So regardless of the IV, the MAC is the same for all such messages. So if you encrypt several zero messages you can leak that fact through the MAC.
When you take padding into account this exact issue is no longer possible, but you should see how it is possible for the MAC and encryption functions to end up using the same values.
It is not secure.
Suppose an attacker Mallory has oracle access to the encryption device of Alice. Mallory is able to get Alice to encrypt any chosen plain text, but Mallory is not able to decrypt any cipher text that is not chosen by Mallory. A typical, practical, scenario could be that Mallory controls javascript that is executed by Alice's web browser, but that Mallory can't access all of Alice's cookies.
Alice has sent one message that is the encryption $IV^{(0)}||C_0^{(0)}||C_1^{(0)}||C_2^{(0)}||C_3^{(0)}||M^{(0)}$ of the plain text $T_0^{(0)}||T_1^{(0)}||T_2^{(0)}||T_3^{(0)}$. Bob, the recipient, ignores the values of $T_0^{(0)}$ and $T_2^{(0)}$. The block $T_1^{(0)}$ contains a secret value that Mallory doesn't know, and on receipt of this value, Bob executes the command represented by $T_3^{(0)}$.
Mallory might forge a cipher text message that Bob will verify and decrypt as $T_0^{(1)}||T_1^{(1)}||T_2^{(1)}||T_3^{(1)}$, where $T_0^{(1)}$ and $T_2^{(1)}$ are garbage, $T_1^{(1)} = T_1^{(0)}$ (the secret value) and $T_3^{(1)}$ is any value Mallory chooses.
Firstly, Mallory composes the message $T^{(2)} = 0||C_0^{(0)}||C_1^{(0)}||(C_2^{(0)} \oplus T_3^{(0)} \oplus T_3^{(1)})||C_3^{(0)}$, and obtains the cipher text $IV^{(2)}||C_0^{(2)}||C_1^{(2)}||C_2^{(2)}||C_3^{(2)}||C_4^{(2)}||M^{(2)}$ from the oracle.
Secondly, Mallory forwards the message $IV^{(2)}||C_0^{(0)}||C_1^{(0)}||(C_2^{(0)} \oplus T_3^{(0)} \oplus T_3^{(1)})||C_3^{(0)}||C_4^{(2)}$ to Bob. Bob will verify and decrypt it as $T^{(1)}$ above.
