qt_attribution.json issues

I noticed that in qt_attribution.json for qtgrpc:

• two items share the same id "protobuf" but with a different content. Is this normal?
• Shouldn't there be one qt_attribution.json file in /qtgrpc/src/tools/qtgrpcgen/, another one in /qtgrpc/src/tools/qtprotobufgen/ so as to reflect the content of the comment correctly?
• Concerning the 3rd section, does it mean all files inside qtgrpc should also be licensed under Apache-2.0? In that case, why is the SPDX header of each file in qtgrpc not updated accordingly?

Is this normal? Which files are actually affected? Shouldn't the SPDX headers of the files that use external components contain also the license set in qt_attribution?