Update CPT meta data using REST API

On the initial issues, are you positive the plugin is registering the fields to be made available to the api? the register_meta needs show_in_rest => true assigned.

Also, the CPT needs custom-fields in its supports array, 'supports' => array('title','editor','thumbnail','custom-fields') for that to made available when accessing the CPTs api endpoint.

I cover that (with links, etc.) in this answer to a different question:
https://wordpress.stackexchange.com/a/266277/118366

If either of those values are missing, you could possibly hook-in to add them or even overwrite the functions altogether. Just a thought.

I’m considering writing a basic PHP page that will take a product ID, find the correct meta record using a WordPress function, and updating the data by turning posted JSON into a serialized array, but I’m not familiar enough with PHP to do this

For this, look into json_decode and json_encode. You can set assoc argument to true with json_decode and get an array rather than an object.

An (untested) quick example function of retrieving some json and setting the decoded results into a variable:

$json = file_get_contents('PATH/TO/FILE.json');
function the_json_contents($json_to_get){

            $json_in_array = json_decode($json_to_get, true); //json string to array

            return $json_in_array;
        }
function do_stuff_do_json() {
    $json_array = the_json_contents($json);
    foreach($json_array['id'] as $js) { //assuming we have an 'id' key
        $somevariable  = $js['someKey'];
        $somevariable2 = $js['someOtherKey'];
    } 

}

Any examples or ideas on how to get this started, though, or if
there’s a better way to get my metadata updated?

A custom route and endpoint may be the most effective way to do this (assuming it isn’t just the plugin not having exposed those items to the api, as mentioned off the top). You will still need to take into account nonce checks and other possible authentication depending how you’re using the endpoints. Routes and Endpoints and Custom Endpoints are what you looking for in the api documentation; probably Controller Classes, too.

Again, I would check the plugin to see if it has the meta fields registered for the api like mentioned initially.