Indeed, I've taken a second look at a few CR3 monsters and the main issue seems to be the damage they can do on a single lucky attack roll.
A single CR3 monster qualifies as a "deadly" encounter for 4 or 5 PCs of 1st level, while a single CR2 monster qualifies as "deadly" for 4 PCs and as "hard" for 5 PCs. But "deadly" sounds to me like an appropriate encounter for the
ending of a an adventure, otherwise there is a good risk of an underwhelming finale. I've used "deadly" encounters all the time at higher levels, but admittedly it's been a few years since I DMed a 1st level game, and previously I did that only for beginners (of either 5e or D&D as a whole) which means I went
very easy on the combat pillar.
Looking at some iconic monsters of CR3, their single-turn damage is just way too high, they seem
very likely to kill a 1st level character, for example:
Mummy: average damage is 20, and that's actually enough to insta-kill anyone with 10hp (but also martial types who have lost about half their hp already); if it scores a critical, it rolls 10d6+3 and the average is 38, yikes!
Minotaur: average damage with greataxe is only slightly lower with 17, and this monster is harder to hit and has more hp than the mummy so it will last a longer number of rounds
Blue Dragon Wyrmling: average damage is 11 which is a lot better, but then obviously it has the breath weapon which averages 22 and hits multiple targets
Owlbear: two attacks averaging 10+14=24 meaning even worst than the mummy (OTOH its criticals are less random and average 39)
I consider the possibility of insta-kill a 1st level PCs due to massive damage the worst eventuality, because it doesn't give a chance to the rest of the party to save the fallen buddy.
Average damage close to 20 is definitely way too risky... When I look at CR2 monsters, they seem to be well below that (except other Dragon Wyrmlings' breath weapons). Insta-kill can still happen on a crit or a lucky damage roll, but if it happens on an
average damage roll then it sounds quite likely that it
will happen
There's still however a few monsters at CR3 which seem to be less risky in terms of insta-kills. They have damage resistance though, which can make them last longer, so it's possible that their typical average
encounter damage is on par with the previous, but still at least they don't insta-kill PCs unless they crit or roll luckily:
Werewolf: two attacks with average total between 10-13, but with possible lycanthropy curse
Wight: two attacks with average total between 11-12, but with possible max hp drain