I believe the misunderstanding is that the squads do not "own their own product".
Typically, in the Spotify model, Squads will own part of the system or product. Squads are aligned into Tribes. In an organization with multiple, distinct products, I would expect alignment between Squads and Tribes in a way that each Squad or Tribe is aligned with one and only one product.
In Jira, the notion of a "project" best aligns with a product. You can see this in the fact that projects in Jira contain information about components, versions, and releases, which are typically associated with products. I handle multiple teams working in a single product (represented by a project) using a field on the issue. This lets me set up my filters appropriately.
If you are performing black-box testing on a system, you should know which product you are testing. Since you know the product, you should know which Jira project represents that product. The black-box system tester can log a defect against this project, initially without assigning it to the team. The Tribe Lead and Product Owner can review these submitted issues to determine which team is likely best suited to investigate and fix. Of course, it could be a cross-cutting concern that has a dependency across two (or more) Squads, as well.
In your particular example, the "webshop" is a product. However, there may be Squads around the ordering service, the inventory management service, and the payment service. If you are performing black-box testing, you would not know which service the issue is in, but you should know that it is in the webshop and there should be a set of people who can review, triage, and allocate the bug and its solution to one or more of the appropriate teams.
Two things to consider:
First, the Spotify Model may not work. It was described in an idealized way. It was never done as it was described across the organization. The things that were done were done because they worked for Spotify and it was never meant to be copy/pasted into a different organization.
Second, it seems like testing is not aligned to either the Squad or the Tribe. Or, perhaps, it's a separate "black-box testing team" that is part of the Tribe. Either way, it seems like there's a disconnect between the testing team and the Squads delivering the work. I'd want to dig deeper into what's going on there.