So much web development ignorance here
Astonished by how many people blame the Chipotle devs. This is first and foremost a problem triggered when one web site uses a form field with the same name as some other form elsewhere that the user has already previosuly completed. "Elsewhere" means anywhere in the entire internet. No amount of coding on the client side can prevent autocomplete from inserting what it thinks should be there. If anyone is to blame here is the browser developers who do not honor the "do not autocomplete" DOM attributes.
True, there are things the Chipotle devs can do to at leats mitigate that, like using aonother name for the field (note that flagging to autocomplete that it should not mess with the field may result in these same "usability experts" complaining about having to type the CC expiry year all the time!) And they should do whatever it takes to streamline the customer experience. But definitely they should not get so much blame as the comments imply.