Investments goes through "due diligence" between signing a term sheet and closing. During this time, the VC gets to look at the company's financials, legal liabilities, and all the other stuff that they don't get to look at before then.

On the engineering side, it's common for investors to ask for a list of software vendors and open source licenses. It would seem pretty legit to me for an investor to ask an outside firm to audit whether a product's code matches what they claim during the pitch.

for the same reason any company accepts due diligence: they won't get the investment if they don't accept.

Of course all of these are negotiable and not all investors do their due diligence, but it is in a well-performing VC's interest to do so.

I don’t know how common it is.

All I know is that I had a short gig last year to do a code review on a potential acquisition, so this can happen at least sometime.

This was for a much smaller product, though.