I have seen other questions like this one, but I am asking this specifically in the context of Riot messaging and the underlying Matrix protocol.
A basic summary of their message encryption (using keys derived from the key ratcheting Olm primitive, details in the section "Olm authenticated encryption" in the Olm spec) is that messages are encrypted with AES-256-CBC, then authenticated with truncated HMAC-SHA256. Only the first 8 bytes of the HMAC code are sent with the message.
Doesn't this provide only 64-bit protection against MAC forgery? Wouldn't it make more sense to include at least 128 bits so as to match the security of the Curve25519 identity keys underlying the ratchet?
While the 2012 NIST document linked in this answer states that at least 64 bits of HMAC is recommended, is a higher security margin called-for nowadays?