If we agree applying a cypher multiple times is more secure than once (like 3DES is more secure than DES), then there is a security argument that can be made for using Authentication-then-Encryption in practical applications.

In many network applications, only part of the data is encrypted (`m`), and some data, `a` (aka. `additional authenticated data`, usually some header data including nounce) is authenticated but not encrypted.

In such a scenario, if we apply encryption first, then we will get `A(a + C(m))` for `EtA` scheme, and `C(A(a+m))` for `AtE` scheme. Now notice how both `a` and `m` are better protected by two layers in the `AtE`, while `a` is only protected by one layer of cryptographic operation for `EtA`.

In other words, suppose both C and A use AES-128, and somebody is able to crack one pass of AES-128, but not two passes of AES-128. Then `EtA` will be not secure but `AtE` still is.