As per topic, why can't we use the first block as MAC instead of using the last block? what's the rationale?
It's also worth considering the point of a MAC in the first place, i.e. - why it should be calculated over all of the input rather than just the first block. Making the tag dependent on only the first block of the tag would allow an attacker to fill in the rest of the message with whatever they wanted, so long as the first block of CT represented a valid tag.
More specifically, consider a chosen message attack scenario where an attacker had some $$(IV, M, T)$$ with $M = M_1M_2M_3$. If the $IV$ was not constant, the attacker could construct another tuple $$(IV', M', T')$$ with the property that:
$$IV' \oplus M_1' = IV \oplus M_1$$
Then, $M_2'$ and $M_3'$ could literally be anything at all and the tag would remain valid $(T = T')$.
If, however, the $IV$ was constant (which it should be in practice), the attacker could just keep $M_1$ the same, so $M' = M_1M_2'M_3'$, and the tag would still be valid.