I see this often enough that if I was a bad guy, I'd just review every multiply in the code.

Which suggests that QA should do this, too.