Security of 64-bit truncated HMAC of Matrix protocol
I once had a similar question, and the answer is that: MAC forgery attack targets interacting parties, where as other types of attack such as key-guessing and message decryption targets static messages. 

To attack interacting parties with MAC forgery, you can only know if you succeed after they've replied decryption success/failure indication, by which time they would probably have terminated the communication or re-keyed. 

On the other hand, if you've enough money to spend on a supercomputer to crack a 64-bit key to decrypt a ciphertext, you can wait as long as you want, and each failure doesn't cause you to start all over again - you can continue where you left.