Incorrect paths not returning a 404

This behaviour can also be overridden for specific routes in a custom module using the following:

/**
 * Implements hook_menu_get_item_alter().
 */
function custom_module_menu_get_item_alter(&$router_item, $path, $original_map) {
  $router_path = $router_item['path'];

  if ($router_path === 'node/%' || $router_path === 'taxonomy/term/%') {
    if ($router_item['number_parts'] < count($original_map)) {
      $router_item['page_callback_original'] = $router_item['page_callback'];
      // Show a 404 response.
      $router_item['page_callback'] = 'custom_module_menu_not_found_callback';
    }
  }
}

/**
 * Callback to flag the response as not found.
 */
function custom_module_menu_not_found_callback() {
  // drupal_not_found(); drupal_exit();
  return MENU_NOT_FOUND;
}

It could be theoretically made into a contrib module which allows users to set the max amount of URL components that are allowed for a specific menu route.