LoRaWAN 1.1. standard says on Page 16 "For Join-Accept frame, the MIC field is encrypted with the payload and is not a separate field".

In other scenarios the message integrity code is a separate field, so the message is encrypted before the MIC is generated if I understood this correctly. It is considered to be more secure to use Encrypt-then-MAC.

Do you have an idea why MAC-then-encrypt is used for this message type?