It's an improvement because middleboxes can't mess up your packets when you're using authenticated encryption. Sure, they can still drop all of them, but that's

It's an improvement because middleboxes can't mess up your packets when you're using authenticated encryption. Sure, they can still drop all of them, but that's a much easier problem to debug than otherwise. We have all these problems because a lot of middleboxes crap their pants when they "see" something in the protocol headers that their developers did not consider because it didn't seem to happen on their laptops or whatever. So you make the protocol headers invisible to the network's middleboxes to prevent the middlebox developer's broken mental model about that protocol from breaking your pipes.