If we agree applying a cypher multiple times is more secure than once (like 3DES is more secure than DES), then there is a security argument that can be made for using Authentication-then-Encryption in practical applications.

In many network applications, only part of the data (`m`) is encrypted, and some data, `a` (aka. `additional authenticated data`, usually some header data including nounce) is only authenticated but not encrypted.

In such a scenario, if we apply encryption first, then we will get **`A(a + E(m))`** for Encryption-then-Authentication scheme, and if we use Authentication-then-Encryption, we get **`E(m + A(a+m))`**. Notice how both `a` and `m` are effectively protected by two layers of cryptographic operations with `AtE`, while `a` is only protected by one layer of cryptographic operation with `EtA`.

So suppose both encryption and authentication use AES-128, e.g. when using AES-128 CCM, and the attacker has resource to crack one round of AES-128, but not two rounds of AES-128. Then `EtA` will be not secure but `AtE` still is. With `EtA`, The attacker would be able to tamper with the plaintext `additional authenticated data` after it cracked the AES authentication. On the other hand, with `AtE`, she still won't be able to do anything after cracking the AES encryption, since all the decrypted data is still protected by AES authentication.