From first hand experience operating as a contract manufacturing company consultant on a recall that was and was not caused by the contract manufacturing company.
1. On the one that was caused by the contract company - The contract mfg made cookies for customer X, the contractor sourced all ingredients and packaging and in error used non-food grade plastic guides for the dough mix that shredded when heated, little pieces of plastic ended up in 100,000 cookie packs of 3 cookies each. Customer X distributed the packs to 100 small food stores with three of them reporting issues from customers back to customer X who in turn reported immediately to the contract MFG company.
In this case the contractor had already identified the issue and recified it and while Customer X instituted a full recall on all cookies from the 100 food stores it was done in conjunction with the contract company and it was the contract company that had to cover all expenses related to the recall - fortunately no injuries.
The contractor actually should have been more forthcoming - they knew the issue already but waited until Customer X had gotten feedback from the stores, had they been more proactive, it would have been the contracting company that started the alert system.
2. Same contract company again, this time Customer A supplied the packaging material to the contract company who in turn packaged 1,000,000 individually wrapped cookies back to Customer A who in turn was about to distribute them to a number of hotels. The discovery of the issue with the packaging was interesting...
An Auditor had come into the company and in the middle of the conference room table sat a bowl that had wrapped cookies in it - this packaging was damaged in processing, so they took these cookies off the line and would let visitors eat the cookies.
The Auditor was having a cup of coffee and grabbed a wrapped cookie and bit into one and said "this tastes funny - it tastes like chemical!"
So, QA runs a test on the cookies and the package and finds that a chemical was leaching into the cookies from the packaging.
The contract company immediately contacted Customer A who had not as of yet distributed any of the cookies, they stopped the pending shipment Customer A contacted the supplier of the packaging who issued a recall back to the the contract company as well as all of the packaging that was effected with other companies.
In this case, the supplier of the packaging actually paid (via insurance) for loss to the contract company.