The first one is a SecureComponentRef and the second is a SecureComponent. SecureComponent is only passed into code that belongs to the component (e.g. its controller and renderer). In this context you are allowed to cmp.find(auraIdForSomeInternalPartOfYourImpl) and call getElement()/getElements() to access your implementation. SecureComponentRef is what you get in all other scenarios - those where you are referencing a component and should only have public API access to it (methods, attributes, events). This eliminates one of the most egregious implicit (and therefor unsupportable) dependency anti patterns:
var someComponentIDoNotOwn = cmp.find("foo");
var someInternalDOMDetailsIShouldNeverDependOn = someComponentIDoNotOwn.getElement();
or another variation on that theme: cmp.find("foo").find("bar") which reaches into the guts of another component and breaks encapsulation horridly.
Specific to .destroy() that looks like an oversight and I believe we need to add that to SecureComponentRef.