I would expect the heat treatment to be a CCP for all your baked goods. Both raw flour and eggs are recognized as sources of Salmonella. Plenty of spices can be sources of pathogens too.
Going to a longer time or higher temp for quality purposes doesn't make the lower minimums for safety irrelevant.
I've just looked at another HACCP plan for a bread bakery for an audit in two weeks time and it doesn't have baking as a CCP. I won't be raising it as a non conformity because the purpose of baking is not to kill pathogenic bacteria, that's kind of a happy accident. Without baking at well above 80oC for some time, you won't have bread, you'll have some dough that wouldn't go down your production line. No vegetative pathogen will survive the process to actually make the product packable.
What I will be looking at is their cooling area and their maintenance, hygiene etc of it. It's not unheard of in some bakeries for Listeria to end up in product which isn't a big deal if you're just using bread at home, making a sandwich and eating it. Counts are likely to be <10. If you're making a sandwich, storing it for a couple of days in the fridge or, worse, for a few hours at room temperature, then with the water activity of some wetter fillings, that could be an issue. Also just not best practice to have Listeria there at all anyway.
Then I'll also be having a good look into pest management. It's such a common problem in bakeries with SPIs as well as rodents. Rodents LOVE bakery ingredients.
I will of course spend time on their one CCP, metal detection because it's a CCP but I'll focus on the areas which aren't audited so much like validation of it, why they chose the test piece sizes they did etc because this site are audited to death. If the standard requires me to observe a check, I will but I want to mostly understand how they've developed the process they have rather than seeing someone that they want me to see do a metal detection check (who always does it in front of auditors. We all know the drill.)
Would you suggest I have the wrong prioritisation? By making baking a CCP my thought process would be you are... Sorry if that seems a little blunt but that's the whole point of HACCP to put our attention on the areas which are most important for food safety. I'd say that metal detection, pest management and hygiene post baking will be more important than the baking process.
Perhaps though in a way that's why FSMA has gone in a different direction as the three things I've picked out are from experience. Their HACCP plan would suggest only one of them is a major concern.