As you say, it could be some freelance designer or artist whom they commissioned make the maze, and that artist committed fraud against both their customer and the real producer by passing KrazyDad's work off as his own. The company can't really double-check against out-and-out fraud. (I still think they should have financial responsibility, paying the real artist what they paid the supposed artist, even if they are morally off the hook.)
IANAL, and I can't really say whether a court would hold them to have been reasonably responsible for vetting this in their review process. But I do know their review process exists, and that it's very extensive, and that a court would probably not be inclined to give them a pass for ignorance -- even if they had no idea. Even if a freelancer committed fraud against them in passing this off as his own, they are economic beneficiaries of the artwork. So I don't think (?) they'd get a pass. (Would actually welcome a lawyer's input on this thread w/r/t that scenario. EDIT: A lawyer has joined in.)
Whatever the case may be, Kraft should do the right thing here. That probably means paying KrazyDad a fee or royalty of some kind, commensurate with the standard that they'd pay a typical artist whose original work graced their package. They should also issue a formal apology and pledge to improve their review process.
If Nickelodeon / MTV Networks was also involved, things get messier, and maybe there's a he-said, she-said dynamic that plays out. In any event, none of these folks are dummies. I sincerely hope, and would even expect, that they'll contact KrazyDad to make remedy.
In these circumstances, the company will have committed the copyright infringement also by virtue of reproducing the maze on the packs, and will therefore be exposed to a potential suit (assuming the other requirements of copyright infringement are able to be shown).
At the same time, the company will have taken an indemnity from the freelancer which means they can go against the freelancer for costs arising from a third party claim of infringement (as is the case here). This would give the company the ability to settle with the third party and then go against the freelancer for the sums.
The principal problem with this is that the freelancer is unlikely to have assets to back the indemnity (unless as a condition of their provision of work they were required to have in place insurance). Even with insurance of course, it may not be available if the freelancer has behaved fraudulently...
It is your responsibility to know the license (or lack of) for materials you publish.
In a case as described there may be some sort of indemnity clause between the publisher (kraft) and the freelancer which passes the costs on to the freelancer under these circumstances.
