Well clearly having altitude/velocity readings is critical to autopilot function, so some kind of redundancy should be put in place. Not necessarily specifically more pilot tubes, but some kind of solution, like heating/deicing the tubes inlets, better placing them, etc -- guaranteeing in some way the chances that all measurements are unavailable is astronomically low.