Opening suspicious files kind of assumes that you immediately do something with the data after decryption. This is a bad idea for both encrypt-then-MAC as well as MAC-then-encrypt and even authenticated encryption.
Many authenticated modes of encryption such as GCM and EAX are online which means that you will immediately receive the ciphertext after encryption or plaintext after decryption. It depends on the interface of the cryptographic library (API) if the online property is available; some higher level API's require you to supply all of the ciphertext plus authentication tag before anything is decrypted.
If you however decrypt first and then keep the result buffered until authentication has taken place then this is not a big problem. As long as you do not process the data before authentication the security of your system should not be at risk (you may of course want to make sure that the ciphertext and tag size is within certain limits).
What is a problem with MAC-then-encrypt is that any vulnerability in decrypting altered ciphertext may result in leaking data. This means for instance that padding oracle attacks for ECB and CBC mode are possible. A lot of the differences between encrypt-then-MAC and MAC-then-decrypt are already explained here.