Put another way, although the product does/can show under multiple categories either on purpose (linked product) or by someone attempting an alternate category (say the product is now in category 42, someone store's that link, and then later it is mapped to (linked) to category 38), the product is identified to a master category and as a result the canonical link should show the master category. By the canonical link identifying the product as belonging to category 42, regardless the entered cPath value, the product is seen as being a single product having multiple ways to get to it.
The cPath is an indicator of association to the product, it doesn't uniquely identify the product. The products_id is what uniquely identifies the product. If a product exists under one category now and is then moved (not necessarily linked) to another category and the request is implemented, instead of the product being located and the new canonical link provided, the product will be identified as no longer existing and need to be found again by either users or search engines.
Now, because you indicated that your site is using Zen Cart version 1.5.1, released nearly 7 years ago, if you by chance are using the now recommended all https: style of access, the above discussed canonical link will not be present and could be a reason that you may come across issues. As of production released version 1.5.3, if the site was made all https: by this instruction: https://www.zen-cart.com/content.php?56-how-do-i-enable-ssl-after-i-have-installed-zen-cart then the canonical link would be provided on https: pages.
I personally don't recommend implementing the requested change, but it's not my site.
I would think that the best place to incorporate the desired change would be in includes/init_includes/init_sanitize.php
Towards the end of the file is a check to validate products_id for search engines and bookmarks, etc.
Within that section, if you are going to implement a product not found type action then would suggestevaluating the provided cPath to see if the product is found in that category and if not to do the redirect to the product not found page. Understand though also that such search on each product page will use additional resources to validate the information being compared. Further also note that while the cPath was called into question, there also is a similar "difference" possibly seen by using a different main_page parameter value. For example you showed product_info; however, the product would likely still show if document_product_info or say perhaps product_free_shipping_info.