My opinion is that you wouldn't.
$product->get_image() are both escaped further upstream. In the WordPress Coding Standards sniffs for PHPCS, these would be referred to as "auto escaped functions".
Double escaping by putting
wp_kses_post() on everything that's already escaped, just to satisfy code sniff, is a waste of resources and not actually doing anything to solve the problem that the sniffing is supposed to solve in the first place.
The reason PHPCS is flagging these lines even though they're escaped is because the WP Coding standards don't know about 3rd-party functions. If your project is using them, or has its own auto-escaped functions, you should configure your project's rules to cover them. For example, adding this to your projects
phpcs.xml file will stop PHPCS complaining about
wc_price() not being escaped wherever it's used:
<property name="customAutoEscapedFunctions" type="array" value="wc_price,"/>
customAutoEscapedFunctions doesn't support class methods, so to satisfy
$product->get_image(); you would use an inline comment:
$product_img = $product->get_image();
echo $product_img; // phpcs:ignore WordPress.Security.EscapeOutput