> outside of lacking attribution / retaining copyright, I don't see a problem?

That's a bit like a shoplifter saying "well, outside of not paying for it, I don't see a problem?".

Apache 2.0 clearly says you must include the license, include copyright, state any changes you've made and include the NOTICE file. None of that was done, so this is a pretty clear violation of the license. The copyright holders can demand that this is fixed immediately, seek at least an injunction if that does not happen, and maybe even claim profits made from selling the software while violating the license.