Will having product ID in URLs hurt SEO compared to a URL with only keywords?

You should definitely use the ID version of the URL, as it makes sense for development. In fact, your final URL is still cleaner than a lot of e-commerce URL's out there that still rank.

Google and Bing will still understand that the page concerns Optimus Prime file in the Superheroes directory. The number will just be ignored. Search engines have gotten very good at extracting meaning from content, which includes URL's, but they are not as literal as people often give them credit for. Besides, the URL is only one of the many ranking factors in SERPs; that product ID is very unlikely to move the needle in any direction by itself.

How

• Include the id in a sensible place. Easiest is have .../product/$id/name-of-product etc.
  • works with pretty much every routing system, no regexes
• Add a <link rel=canonical> (or however you spell it, it’s a while since I had to do this) to a url with just the id ¹
• When handling requests, if the url doesn't have the correct text then do a redirect to the url with the current correct text in.

Why

• When you (inevitably) have to change the text for some product:

  • Google will see old and new versions as the same page / entity / product
  • old uncorrected links will still “work” (and be redirected to new ones)
  • this applies to incoming links from other sites, too, so you don’t lose your “Google sauce” (or whatever the cool kids are calling it these days)
• When (almost inevitably) you have multiple products with the same name (especially if you have a popular item that gets “updated” or “restyled” etc.) but different IDs, both can have a link that works (might help you sell off the old stock)
  • you can always add a link to the “new” product on the “old” one’s page

Typoes are inevətəble. If they want to count on keeping product names unique, and never having them corrupted by double-UTF8-encoding or whatever, tell them they get to keep both pieces. Including going through the 404s in the webmaster tools …

¹ This isn’t essential, since a link with the “wrong” text in will redirect anyway. As long as it does have the id in it, it’s more-or-less unbreakable.