No. Length extension attacks are not attacks against hashes as hashes. They're attacks against hashes when used for purposes that require stronger security properties.
A length extension calculation on a Merkle-Damgård hash allows an someone to calculate $H(A||S)$ for a specific non-empty suffix $S$ given the knowledge of only $\mathsf{length}(A)$ and $H(A)$ (but not $A$ itself). The adversary does not get to choose $S$ or $H(A||S)$. This can only ever be an attack when part of the security protocol is that $A$ is secret, because if $A$ is public, then everyone can calculate $H(A||S)$ for any suffix $S$. The best known example of construction where length extension is if you try to build a simple MAC out of a hash function by defining $F_K(A) = H(K||A)$ where $K$ is a secret key. In order for this to be a MAC, it must be infeasible to calculate $F_K(A')$ for any $A' \ne A$ even knowing $A$ and $F_K(A)$. If $H$ is a Merkle-Damgård hash, the length extension calculation allows an adversary to calculate $F_K(A||S)$ for some non-empty $S$ from $A$ and $F_K(A)$ (and the length of $K$), without knowing $K$ itself. This doesn't affect the security of $H$ as a cryptographic hash, but it means that $F$ cannot possibly be a secure MAC.
The Merkle-Damgård length extension property does not contradict the preimage resistance of a hash function. A popular way to state preimage resistance is that it's impossible to find preimages except by brute force. When phrased this way, length extension looks like an attack, because it allows finding the preimage of $H(A||S)$ from $H(A)$. But this formulation is only an approximation. A more precise (but still not fully precise) definition of preimage resistance is that it's infeasible to find a preimage for almost all potential outputs, or in other word that almost no potential output has a preimage that can feasibly be calculated. The length extension calculation means that if you've calculated one image, you get one preimage for free. This at most doubles the number of preimages you can calculate (and in fact much less because there are many $A_i$'s such that the length-extension $S_i$ results in the same extended input $A_i S_i = A_j S_j$). Less than twice almost none is still almost none.
The Merkle-Damgård length extension property does not contradict the collision resistance of a hash function. Collision resistance means that it's infeasible to find $A \ne B$ such that $H(A) = H(B)$. Length extension makes it possible to find $A \ne B$ such that $H(B)$ can be calculated from $H(A)$, but that's not a collision since it's infeasible to find a case where $H(B)$ would be equal to $H(A).
When hashes are used as file checksums, the property that matters is collision resistance, or the weaker property second preimage resistance. As we've just seen, length extension does not make it possible to find collisions.
Because Bob's fake ISO checksum matches the official ISO checksum
No, it doesn't. The fake ISO checksum can be calculated from the official ISO checksum, but it's a different value.
is SHA256 completely insecure when a file's file size is not also included in the verification?
No. SHA256 is secure even when the file size is not included. Including the file size doesn't help in any way. And for MD4, MD5 and SHA-1, which were formerly believed to be secure but now have known collisions, the methods to find collisions allow the colliding messages to have the same size, so including the file size doesn't help either.
