Here are two scenarios. The first one happened to my student, the second (or something like the second) happened to a student of @bstrickl . In both, the student was given multiple attempts on the quiz and the setting was for the highest score to be the one that counts.

(1) The student took the quiz before the due date and scored a 10/10. After the due date, because he had an attempt remaining, he took it again (in preparation for a test). He scored below 10/10, but the late penalty was applied to the 10/10, and so now his grade on this quiz is lower than it was when he did it before the due date.

(2) The student took the quiz before the due date and scored an 8/10. After the due date, because he had an attempt remaining, he took it again (in preparation for a test). He scored a 10/10, but with the penalty applied to this 10/10, his grade on this quiz is now lower than it was when he did it before the due date.

So, I can see that---at least to all appearances---Canvas, first, takes the highest score from all of the attempts and then applies the late penalty to that attempt (no matter when it occurred). However, the correct behavior, I think, is, first, to apply the penalty to late attempts (and not to on-time attempts), and then select the highest score.