(At this point I'd be puzzled by anyone doing generic composition of ciphers and MACs, given the available options.)
That doom principle is: "When you receive a message, the very first thing you can do is verify the MAC".
What confused me was the name of Moxie Marlinspike, because this principle was not coined by him (in 2011), but it was discussed at length during the nineties of the last century, by the designers of IPsec, a decade and a half before Moxie.
This principle was the reason why IPsec chose to do "Encrypt-then-MAC", unlike SSL or SSH. The differences between IPsec, SSL and SSH in the order of encryption and MAC computation prompted Hugo Krawczyk to write in 2001 his paper "The Order of Encryption and Authentication for Protecting Communications (Or: How Secure is SSL?)", which clarified the properties of the 3 different orders used at that time by IPsec, SSL and SSH.
Nonetheless, this "Doom Principle" is obsolete.
30 years ago, when IPsec was designed, it was true that doing first only the MAC computation saved time for the case when decryption was no longer required (because the packet was corrupted or forged).
Nowadays, reading the encrypted data from the memory is normally the bottleneck, not the MAC or decryption computations. Therefore, one should never do 2 passes over data, one for MAC and one for decryption, but one should do a single pass, during which both MAC and decryption should be computed, regardless which is their order. Even when small packets are decrypted, so the second pass would find the data in the cache memory, doing a single pass over the data is still faster.
When a single pass over data is done, it no longer matters in which order MAC and encryption had been done, regardless whether the data passes or fails the integrity verification.
> I'd be puzzled by anyone doing generic composition of ciphers and MACs, given the available options
I agree. Today, most people should use only one of the standardized authenticated encryption algorithms, like those specified by TLS 1.3 or SSH.
On most modern CPUs (which have dedicated hardware for both AES and the GCM MAC), doing something better than this cannot be achieved by any generic composition of ciphers and MACs, but it can be achieved with other authenticated encryption algorithms, which have not become widespread mostly because of the broken US IP laws (i.e. they were covered by various bogus patents).
I was writing about EtM constructions before Moxie wrote that post (you can see me preening about Bellare and Namprempre in Twitter search), but Moxie's post is the one everyone remembers, so that's the reference. What's "obsolete" about the advice now is that nobody builds cryptosystems by manually gluing a block cipher mode to a MAC anymore. But in the 5 years prior to that post, violations of the "principle" were the most reliable way to break cryptosystems.
Nobody's arguing that cryptographers can't design hermetically sealed authenticated encryption modes that play with the ordering of encryption and authentication. That wasn't what Moxie was implying either.
I think that you might confuse IPsec with SSH in this statement.
IPsec chose since the beginning "Encrypt-then-MAC", which is proven to be secure with any good encryption and MAC algorithms.
In the beginning, SSL used "MAC-then-Encrypt". This is proven to be secure only with certain combinations of MAC and encryption algorithms. Nonetheless this was not a problem for SSL, because the combinations that they used were by chance among those correct.
SSH used in the beginning "Encrypt-and-MAC", which is the worst choice, and in certain SSH variants it was actually vulnerable.
So I think that you remember some story about SSH, because IPsec got it right since the beginning.
In general IPsec has never had any problem in its purely cryptographic design choices, but its initial variants had ridiculously complex management methods, which could result in security problems due to key or access rights mishandling.
Later, IPsec was simplified, but it had already acquired a bad reputation as being extremely hard to use correctly, which allowed other VPN solutions to become much more popular, like OpenVPN, which were much easier to configure and use.