As per previous post, both additive/multiplicative/hybrid methods for estimating risk are in substantial use for both non-matrix and matrix purposes.
Yr question is a relevant one but afaik a consensus of preference does not exist. I daresay this is because a very large range of different types of applications/probability distributions (eg discrete/continuous) are involved. Plus a reluctance to complicate what has been considered an effective methodology.
In fact, over last 10-20 years, a number of specific criticisms regarding matrix use have arisen in the literature. However these have mostly been ignored by the user communities since the risk matrix has provided an unusually convenient, pictorial, readily explainable tool for a non-simple subject like risk assessment/risk ranking.
One potentially significant factor in the choice of (x or +) calculation of risk is the nature of the (x,y) scales used for the risk matrix, eg linear vs logarithmic, the two options favoring multiplicative/additive respectively (most textbooks avoid such scale nuances). This is discussed in detail in this recent review -
A practical example of a (claimed) justified preference (multiplication) is here –
Risk matrix methodology.pdf 1.24MB
Other publications seem relatively unconcerned, eg –
semi-quantitative (multi-criteria) analysis: scores for each scenario to be evaluated are combined with the appropriate weights and are combined to produce a final risk estimate using simple additive or multiplicative models.
Risk assessment for control.pdf 1.25MB
Personally, I would guesstimate that the majority of FS literature uses multiplication although exceptions certainly exist.
PS - One more useful discussion on risk matrix, particularly scales. Similar content to first above but maybe little more easily readable/explained.
Risk assessment,challenges and recommendations.pdf 619.83KB