There are several sources stating that canonical and noindex should not both be used on the same page, and that’s just what oxid does, there is also a bug entry for this: 0006201: Additional product urls should not be no-index - OXID eShop bugtrack, so this comment “when product page is accessed over vendor or manufacturer views, it should be not indexed” is kind of outdated.