The appendix is a set of instructions. It is intended to describe the recommended best practice for licensing your own code under the Apache License. It is not part of the license itself. Failing to follow those instructions does not necessarily invalidate the license, but it may create legal uncertainty depending on the specific fact pattern.
Pragmatically, this is a matter of how much legal risk you (the consumer/user) are willing to take on. When you use someone else's code without a valid license, you infringe their copyright, and they can sue you for damages. A license eliminates this risk by giving you permission to use the code. From the perspective of risk mitigation, there are three basic questions you need to ask:
- How likely is it that the rightsholder will sue me?
- How likely is it that they will be able to convince a judge that the license is invalid?
- How expensive is a lawsuit likely to be?
You will need to evaluate these things on your own, because nobody else knows your exact business situation and risk tolerance, but in general, risk is lower in cases where you have an explicit statement, (presumably) written by the rightsholder, claiming that the license applies (which is the case here, see the README: "Licensed under the terms of the Apache License, Version 2.0."). When you have such a statement, it is weak evidence that the rightsholder is not interested in suing you, and more importantly, it is strong evidence that the rightsholder actually intended to give you a license, that the license is valid because of that intent, and if the license is somehow invalid, that you may nevertheless have equitable defenses such as estoppel and/or innocent infringement.
In cases where the rightsholder merely dumps the text of a license into a file called LICENSE or COPYING, with no licensing statement in the README or the comments of individual files, there is less evidence of intent, and so the risk is mildly higher. However, judges generally don't like this sort of trickery, and overall risk is still not that high in my subjective opinion.
More risky is the case where there are multiple licenses in the same repository, and no clear statement of which license applies to which file(s). If you get sued, your lawyer will likely argue that the entire repository was multi-licensed, and that you could choose which license to follow, but it's less clear to me how a court would rule in that case. A judge might rule that the conflicting licenses are insufficiently clear to establish intent.
Finally, if there is no license at all, then by default, no permissions are granted.
