@1: We (the ASF) do own foo.org (I assume that is what you meant). I did a little whois check. We're talking about ofbiz.org (or org.ofbiz) See: http://www.whois.com/whois/ofbiz.org
@2: These are remnants from the pre-ASF era, I suspect as I wasn't around that period or participating in the transition phase to have the poddling become a TLP.
Quoting: From a brand perspective, org.apache.foo is very strongly preferred.
I can imagine that, but even 'very strongly preferred' doesn't make it a requirement, as it implies that not having it so is something that can be lived with. Having it as a branding requirement has far greater implications. I have emailed a question regarding this subject to the office of ASF brand management.
But what is then - given the above - the answer to my question(s)?