Why does TLS 1.3 use random-looking nonces for AEAD? In TLS 1.3, it seems that nonces for AEAD are constructed by XORing the recorded sequence number with the server/client_write_IV (which is generated during the handshake). Thus, nonces are random-looking and cannot be reused as the sequence number monotonically increases.

Why not just use the sequence number? Is there an advantage of having a random-looking nonce for AEAD? If not, how to explain this implementation choice?
As @CodesInChaos mentions in the comment, the purpose of the nonce randomization in TLS 1.3 is to combat multi-user attacks. That is, attacks where the adversary attacks multiple users simultaneously, and is happy as long as it breaks at least one user's connection without any regard to which user this is specifically. This motivation is explicitly called out in the RFC (Appendix E.2):


  In order to prevent mass cryptanalysis when the same plaintext is repeatedly encrypted by different users under the same key (as is commonly the case for HTTP), the nonce is formed by mixing the sequence number with a secret per-connection initialization vector derived along with the traffic keys. See [BT16] for analysis of this construction.


The idea of randomizing the nonce has received analysis in two academic papers:


Mihir Bellare and Björn Tackmann. The Multi-user Security of Authenticated Encryption: AES-GCM in TLS 1.3. CRYPTO'16. ePrint link
Viet Tung Hoang, Stefano Tessaro and Aishwarya Thiruvengadam. The Multi-user Security of GCM, Revisited: Tight Bounds for Nonce Randomization. CCS'18. ePrint link