No consumer packaged goods company, least of all a giant like Kraft, puts anything onto a box without many layers of approval and rounds of creative review. In this case, the buck presumably stops with the brand manager for the Mac & Cheese product. I doubt he or she would have even thought to ask about the IP origins of the maze when conducting creative review. Nevertheless, he or she bears some responsibility as the owner of the review process.
Most likely this maze was lifted and passed off as original by someone a bit lower down the food chain: an agency staffer, a freelance designer, or an artist at the company. But there is virtually no scenario in which that person's contribution wasn't reviewed a half-dozen times by people with managerial authority. At CPG companies, the package is an incredibly important and borderline sacred thing. Nothing gets onto the package by accident, and as such, it would be incredibly difficult for Kraft to argue its way out of responsibility.
Another possibility is that Nickelodeon (the owner of Spongebob) provided the artwork, including the maze, to Kraft. This makes identifying the proximately responsible party a bit trickier, but Kraft still bears a burden. It would also mean that two companies, and possibly two brand managers, had eyes on this.
