That still assumes you can detect the differences which could be heavily obfuscated. And assumes your reverse engineering toolchain isn't infected with the same issue too. While this route is a bunch of work, it does give you good confidence. That doesn't mean you shouldn't do other things as well.