But it is still safe to do random access AES-CTR if you've already checked the MAC. Random access is not a problem, decrypting before authenticating is a problem.