Comment by quotemstr

Classic ciphers are damn fast and small compared to PQC. If you're doing PQC anyway, doing classical cryptography at the same time has negligible cost.

That makes attempts to push PQC-only modes super suspicious to me. Smells like Dual_EC_DRBG.