Thanks for your question.
Please find an answer below, in the meantime I'd like to invite you and everyone else in the Spree community to join Spree Slack channels - a group chat where you can talk to Spree developers and users. We've got over 2200 people there already.
As per your question, our Spree dev says:
You can pass attribute `taxon_ids` as array when doing POST. The same rule applies to `option_type_ids`.
Permitted attributes for products are:
:name, :description, :available_on, :discontinue_on, :permalink, :meta_description, :meta_keywords, :price, :sku, :deleted_at, :prototype_id, :option_values_hash, :weight, :height, :width, :depth, :shipping_category_id, :tax_category_id, :cost_currency, :cost_price, option_type_ids: , taxon_ids: