The position property is read-only. The position of variants is indicated by the order in which they are listed.
That behaviour doesn't sound right. As you already pointed out, the position should be determined by the order in which you declare the options.
This is an unversioned endpoint
Just to clarify, did you mean you're using the unstable version? The product endpoint is versioned in both REST and GraphQL, so if you're not sending a version it's possible there's a conflict between the contents of your call and the API version being served.
Try again with the 2020-07, and if you're still having an issue please provide the product_id and a rough timeframe for when you made your call. I'll use this to find more details in our logs.