When extending the domain of a fixed-length MAC, why do we have to include the message length in each block?
I suspect it is because you can still do a truncation attack under specific circumstances. Say an adversary obtains the tag of another message m' that is shorter than the original message m. Then the adversary can replace the first block from m (the one containing the length) with the first block from m', and also replace the first element in the tag for m with the first element from the tag for m'.

Similary, if the message m' is larger, then a message extension attack becomes possible...