In its section "7.2.4.5 Layers and styles" (page 24), the WMS 1.3.0 spec says:
Each available map is advertised by a element in the service metadata. Conceptually, each Layer is a distinct entity. However, as a means of classifying and organizing layers, and as a means of reducing the size of the service metadata, a single parent Layer may enclose any number of additional layers, which may be hierarchically nested as desired. Some properties defined in a parent layer are inherited by the children it encloses. These inherited properties may be either redefined or added to by the child. Subclause 7.2.4.8 summarizes whether or how each property is inherited.
A server shall include at least one element for each map layer offered. If desired, layers may be repeated in different categories (i.e. enclosed in more than one parent ) when relevant.
(emphases mine)
In my opinion, this wording is somewhat ambiguous, or at least doesn't explicitly disallow more than one top-most <Layer>.
However, on page 63, the Annex E -- which is explicitly declared as normative -- gives the XML schema as:
<sequence>
<element ref="wms:Request"/>
<element ref="wms:Exception"/>
<element ref="wms:_ExtendedCapabilities" minOccurs="0" maxOccurs="unbounded"/>
<element ref="wms:Layer" minOccurs="0"/>
</sequence>
As per this answer, the default value for maxOccurs is 1, so the answer can be given as a clear NO.
No, the element is not allowed multiple times there; no, the sample XML is not valid; and no, this is not a bug in OpenLayers.
QGIS probably works around it anyway so that servers can be used even when they are not 100% compliantly implemented. ODC OWS should probably give a warning when configured like this, or wrap the whole thing in an additional <Layer>...</Layer> if it encounters more than one top-most layer in the user-supplied config.