I just confirmed this is happening in my dev org as well. It also looks like others are running into this issue as well. Stolen from a link on the Developer Boards by sfdcfox,
I've confirmed this behavior. It's calling the standard edit
controller ( /{!Product2.Id}/e?act=0&retURL... ) that does not have
the usual save=x parameter (where x is any value, but usually the word
Save). It seems to bypass all validation, workflow, and trigger logic.
Nothing shows up in the debug logs at all. I suspect that this is a
bug, and you should report it to Technical Support.
sfdcfox also posts a workaround to solve this:
...if you
override the product2.edit action with a Visualforce component, you
can perform the update in your custom code, which fires your trigger
correctly. This is only a shortterm solution, as it introduces a CSRF
attack, but is no worse than the original problem, which is also CSRF
vulernerable. Alternatively, have the edit page offer them a chance to
cancel or confirm the action so you yourself prevent the CSRF attack.