I would like to remind you people that we are not talking about abstract problem spaces where you can count on the problems being essentially "randomly selected" for some suitable definition of random. We are talking human-created financial instruments, being created by agents with every incentive to game the system. Complexity analysis is a whole different kettle of fish when you have to assume a malicious agent generating the problems! Everything you think you know about approximation may or may not apply, and probably doesn't apply, because approximation algorithms never (or virtually never) start out with "Assume a hostile malicious agent has constructed your problem instance..."

The correct mindset here is probably the security mindset, where no matter how small or trivial the "arbitrary command execution as root" vulnerability is, you damn well better close it, because in the computing world the smallest crack can be easily widened large enough to drive a truck through.