The “hitting pedestrians” is an extreme hypothetical, and not one you should particularly get hung up on. But it is one that still has to be considered. Passive security measures only go so far for the passenger.

Realistically, a car can get out of many situations without hitting hostile pedestrians, such as reversing rapidly and then driving in an opposite travel lane to bypass the blockage. Or hopping a curb and using a sidewalk if it is not occupied (or just blasting the shit out of the horn if it is occupied). All things that waymo’s auto mode cannot and will not do, because it doesn’t have the reasoning to understand when such measures are necessary.