After obtaining the key and tag for CMAC, an intruder can apply repeated decryption to get the blocks of the message until it represents a valid English text (assuming common case). For HMAC, it is difficult due to the brute force required to reverse the hash function?
Is my understanding valid?
Side note: Such reverse derivation of the message is important in the case of network protocol where parts of a message are sent with AES-CMAC function. The corresponding keys (nonces) are also revealed in the later exchange of messages.