Is it possible to fake any file's SHA256 checksum with Length extension attack? Is SHA256 completely insecure when file size is not also checked?
Bob compares the SHA256 checksum that he generated from fake ISO file to the checksum found on official linux distribution's home page. Because Bob's fake ISO checksum matches the official ISO checksum, Bob doesn't notice that he has downloaded fake ISO


I highlighted the incorrect assumption: the checksums wouldn't match.
What the length extension attack allows someone to do is, given the hash of an unknown message $M$, compute the hash of a message $M | pad | X$ (for a specific string $pad$ which depends on the length of $M$, and an arbitrary string $X$).
However, the hash of $M | pad | X$ will not (in general, that is, barring an extremely improbable coincidence) be the same as the hash of $M$.
If it were, that would count as a hash collision, hence disproving the collision resistance of SHA256.

Is this trivial to do?

It is believed to be infeasible  to make the hashes match.  Yes, the adversary could compute the hash of $Y = M | pad | X$, however because he knows what his image $Y$ is, he could compute its hash without any special properties of the hash function.