I think I perfectly understand your puzzlement. Let's see if I can relieve some of it.
First we have two specimens to examine:
(I think in ②, after the "付録", a "が" is required, formally speaking, because "まで" that 'absorbs' it in ① is dissociated from the subject in ②.)
In ①, the implication is that something other than the "付録" is already included, since the "まで" attaches only to the "付録".
Whereas in ②, the implication is that some event other than "付録 is included" is present, since the "まで" modifies the entire "付録がついて".
This is all well and logical, but being logical isn't exactly what we are when use our language. Despite the difference described above, I'm inclined to say few people would have second thoughts about speaking like ① when what they really mean is ②. In fact I believe to talk like ② would be something of a hypercorrection. (As far as this case is concerned, that is. There are many occasions where using "まで" after the verb is fine, preferred, or is the right choice.)
(Had I written "the 'まで' only attaches to the '付録'", instead of "the 'まで' attaches only to the '付録'" three paragraphs back, would you have understood any differently?)
So, the bottom line is, "しかも付録までついてこれは買うしかない！！" is just exactly how we usually talk. (And there's something about this sentence that makes using ②付録がついてまで exceedingly inapt here. Can't say what, though.)