No, this isn't a fundamental weakness of CBC. In fact, CTR is even more susceptible to this problem (a CBC bitflip totally corrupts the block to which it's applied, and creates a predictable change in the subsequent block; a CTR bitflip simply flips the matching decrypted plaintext bit; in that sense CTR is totally and perfectly malleable).
Also: nobody uses SHA1 anymore, SHA1 and SHA2 aren't MACs (you're thinking of HMAC), and even MD5 is still unbroken in HMAC.
Of course a problem with encrypt then authenticate is that you can verify the identity of the sender without decrypting the content, which is of course why A then E happened in the first place - the threat model turned out to be incorrect. For messaging platforms I would still lean towards authenticate then encrypt as I think the attack model is different.