What’s up with the Salmonella recall of Ritz crackers and Goldfish?

I am baffled by food safety issues related to the recent recall of Ritz Crackers and Goldfish by their manufacturers, Mondelēz and Campbell/Pepperidge, respectively.

I understand how their whey protein ingredient could be contaminated by Salmonella.  Whey is an excellent growth medium for bacteria.

What I don’t understand is how people eating Ritz Crackers or Goldfish could become ill with Salmonella (the New York Times reports two cases of illness).

Aren’t crackers baked?  Isn’t that a kill step?

I can understand why Mondelēz would issue a recall as a precautionary measure.

But can someone please explain to me how Ritz Crackers or Goldfish could contain live Salmonella from whey baked into them?

I am not the only one puzzled by this.  BakeryAndSnacks.com quotes Stewart Eton, an industry food safety official, who emphasizes that baked goods undergo a kill step.

This would ordinarily be a CCP [Critical Control Point] under their HACCP [hazard analysis and control plan] program with the process validated and verified at regular intervals.  Under the FSMA [FDA’s food safety laws], for example, this risk-based rationale would be deemed sound and would not require a recall.

What’s going on here?

A possible explanation

A reader writes that flavoring agents are sprayed on to Goldfish after they are baked.  If this is true, Goldfish would be make in the same way as dry pet foods and would not be sterile.