so I wanted to know if it is legal to use the Cypress VID/PID combo in a product that will be sold.
I'm afraid you can't.
If you want to use a Cypress USB IC then you will have to shell the $2000 needed to get a VID. Another aproach could be to get an IC to do the USB stuff from another vendor that has a PID program like Silabs, FTDI, or microchip and connect it to a PSOC using UART. This of course adds BOM cost and board space.
Technically you can do that - there is nothing which prevents this. But you cannot sell your solution to someone else. And I think it might even get difficult to share the program code using this VID/PID. (Not in a technical sense, but it is a legal problem).