I just noticed that some of my libvirt VMs had on_crash set to destroy instead of restart . It looks like there is an easy fix:
I don't know if something changed in virt-manager / virt-install over the years, or if I ran into this a long time ago and forgot about it.
Now I just need to remember to add that --events option to virt-install in the future... 🙂