I do not understand, what the advantage is in only encrypting the nonce + Ctr and XORing this to our plaintext, instead of encrypting everything. (If our block cipher can be easily decrypted)
What would be the other downsides of turning
$c_i = E_k(n + i) \oplus m_i$
$c_i' = E_k((n + i) \oplus m_i)$
This should prevent flipping a bit without destroying the entire block, right?