Several cryptographers have been wary of this construction, both because of the history of attacks and also because it generally hasn't lived up to the goals of (nonce) "misuse resistant authenticated encryption" as described in the seminal Rogaway paper on the matter:
https://mailarchive.ietf.org/arch/attach/cfrg/pdfL0pM_N.pdf
Several cryptographers have been wary of this construction, both because of the history of attacks and also because it generally hasn't lived up to the goals of (nonce) "misuse resistant authenticated encryption" as described in the seminal Rogaway paper on the matter:
https://eprint.iacr.org/2006/221.pdf
It will be interesting to see more analysis on the latest version. For the intended use case (QUIC ticket encryption) it would be helpful.