It was so that if the downed plane got captured by other forces, they would have less working parts to reverse engineer the function from, not because people were worried about rogue autopilots they couldn't shut off.

When I was in school, a classmate had done a coop for the Canadian military. They used the ADA programming language (iirc), and it was such a safe language that the only unrecoverable exception they allowed in their programs (for a military helicopter) was one where the user had selected the self-destruction option and the exception was so that the program could switch from "flying the helicopter and running its systems" mode to "scramble the memory to minimize the useful data that might be recovered from it" mode.