Retail CPUs usually come with a heatsink that already have thermal paste applied to the bottom the heatsink and there will be a tab / sticker that should say "remove before use" or something like that as you stated above.
If the bottom of the heatsink is bare metal, then apparently you got a heatsink without any pre-applied thermal paste. I suppose this sort of thing can happen on a mass production scale. Each CPU / APU is not individually inspected by a human being. Doing so is expensive and will significantly drive up the price of each CPU / APU.
All you need to do is to buy some thermal paste on your own. Arctic Silver 5 has been around for some time but it is still good stuff. There's also MX-4 and IC Diamond just to name two that are even better and more expensive. One warning about IC Diamond though... it can cause minor / very shallow scratches on the CPU (GPU as well). That is by design and it believe it is partially why it is effective. If you do not want minor scratches on your CPU, then avoid using IC Diamond.