Under what circumstances will the executable first found in the path not be used

which -a cmd looks for all regular files named cmd which you have execute permission for in the directories in $path (in addition to aliases, functions, builtins...).

While which cmd returns the command that zsh would run (which is a builtin in zsh like in tcsh but unlike most other shells).

zsh, like most other shells remembers the paths of executables in a hash table so as not to have to look them up in all the directories in $path each time you invoke them.

That hash table (exposed in the $commands associative array in zsh) can be manipulated with the hash command (standard POSIX shell command).

If you have run the brew command (or which/type/whence brew, or used command completion or anything that would have primed that hash/cache) before it was added to /usr/local/Cellar/zplug/HEAD-9fdb388/bin or before /usr/local/Cellar/zplug/HEAD-9fdb388/bin was added to $path, zsh would have remembered its path and stored it as $commands[brew]=/usr/local/bin/brew.

In that case, you can use hash -r (as in the Bourne shell) or rehash (as in csh) to have zsh forget the remembered commands (invalidate that cache), so it can look it up next time and find it in the new location.