This is not a bug. It's a feature.
The product can be reached at many urls.
For example let's take product with url key 'product.html' and the id 33.
Let's assume the product is in 2 categories. category1 (id 20) and category2 (id 30).
You get the product page at the following urls:
- /category1/product.html
- /category2/product.html
- /product.html
- catalog/product/view/id/33
- catalog/product/view/id/33/category/20
- catalog/product/view/id/33/category/30
The backend setting you enabled does not make the product not available at the simple url (product.html in the example above). It just makes the links listed on a category page to have the category key in front of the product key.
And it would be kind of hard to have a unique url determined by a category and the product keys.
This is because of the feature that allows you to place a product in multiple categories.
For example, in the search results you cannot determine what category to use in the url if there are 2 or more categories.