Regarding your first paragraph, that’s always going to be a tradeoff that has to be assessed based on threat model and resource budget, since doing it differently will inherently leak sidechannel information, right?
The second one, TIL and good points!
Also it lacks authentication. The snapshots of the XTS mode are prone to certain attacks.