The specification lists the constraints to extending a message, and also says that

Changes that break those constraints require consumers to update to the current schema used by publishers. An message template that has changed in an incompatible way must be assinged a new template "id" attribute.

Implicitly, it is the responsibility of the schema publisher to make sure that the message schema conforms to the rules. This should be made more explicit, and conversely, contravening the constraints is considered a protocol violation.