Sure, you can have auto-save without surprising the user. Auto-save to something that isn't the file they opened, and the commit those changes when they invoke "save". The UI itself can show whatever the latest version it has (and offer nifty things like "compare with what's saved"), but the file itself isn't written until the user asks it to be.

I'm not sure what word processing software you've been using for the past decade, but periodic backups and automatic restoration is more or less the norm, now. Heck, even my code editor persists unsaved buffers between sessions.

I think the last time I lost unsaved work in a due to a program crash was probably last millennium. That's the root of my surprise here; there are proven solutions that don't break existing workflows. Why did Apple decide to break them now?