It works because Drupal loads the module file, and uc_product_nodeapi() doesn't exist in uc_product.module. Once the modules are loaded, it doesn't matter what file they came from. Hooks are called by module_invoke(), and since uc_product is an active module, the function uc_product_nodeapi() is a valid hook.

You want to name your hooks after your module so you are guaranteed not to have any name collisions. If I happen to put my own version of uc_product_nodeapi() in uc_product.module, PHP would crash on you.