Three-party protocol for multiplication with output privacy
First, I'll assume that parties' inputs come from a multiplicative group. If they're in a ring and you also want multiplication by zero, then things get harder. In that case, the protocol you describe is not secure even in the semi-honest case.

The protocol you describe is already secure in the malicious case.  $X$ gives random $b$ to $Z$ and $bx$ to $Y$. $Y$ gives $(bx)y$ to $Z$, who computes $b^{-1}(bxy)$.


If $X$ is corrupt, he sends some $b$ to $Z$ and $c$ to $Y$. This achieves the same effect on the honest parties as running honestly with input $b^{-1} c$ in the ideal world, so it's simulatable / not an attack.
If $Y$ is corrupt, she gets $c = bx$ from $X$ and gives $d$ to $Z$. The message $c$ from $X$ is distributed uniformly, so this message is simulatable without knowing $X$'s input. Furthermore, $Y$'s behavior achieves the same effect on the honest parties as running honestly with input $d c^{-1}$, so it is simulatable / not an attack.
If $Z$ is corrupt, there's nothing he can do, since all he does is receive messages.
If $Z$ is corrupt and colludes with one of $\{X,Y\}$, then in the ideal world they can deduce the honest party's input in its entirety. So there is nothing to hide.
If $X$ and $Y$ collude, then $X$ sends $b$ to $Z$ and $Y$ sends $d$ to $Z$. This achieves the same effect on the honest party as them running honestly with inputs $1$ and $b^{-1} d$.