"controls [..] that allow them to be turned off if they get out of control"
Um, where's the problem ?
So you have a pseudo-AI-controlled missile launcher. Let's say that they're not nukes. You'll still have a screen to monitor the status, with a pair of eyes checking that screen, and I fail to see why there shouldn't be a Big Red Button (with a plastic cover) or similar to shut down or prevent any unscheduled launch.
Like, the fuel ignition is connected to a wire that leads to a switch on the control panel (ok, not a button). Flip the switch and ignition is impossible, no matter how many orders the AI sends.
Obviously, the switch will be set to Allow when all is normal, because if there is an alert and the system needs to launch in the next twenty seconds, then there might not be enough time to engage ignition, but then I'm supposing the entire system is doing its job.
It's when all is clear, no issue is at hand, then suddenly the panel goes rogue, red lights strobe and THAT is when you need to know : should this be shut down or not ?
Then again, if we're talking AI-controlled hardware that should react in less-than-human time (and 20 seconds is pretty short if you're not already on DEFCON 3), then go ahead and install all the backdoors you want. First, Beijing will thank you for giving them access and time to plan and second, you will need another AI to use said backdoors in time if it is called for.