Hey Damian,
Thanks for your question.
Please find an answer below, in the meantime I'd like to invite you and everyone else in the Spree community to join Spree Slack channels - a group chat where you can talk to Spree developers and users. We've got over 2200 people there already.
As per your question, our Spree dev says:
You can pass attribute `taxon_ids` as array when doing POST. The same rule applies to `option_type_ids`.
Permitted attributes for products are:
:name, :description, :available_on, :discontinue_on, :permalink, :meta_description, :meta_keywords, :price, :sku, :deleted_at, :prototype_id, :option_values_hash, :weight, :height, :width, :depth, :shipping_category_id, :tax_category_id, :cost_currency, :cost_price, option_type_ids: [], taxon_ids: []