If a chainsaw juggler on a cruise ship cuts my dad in half while he's sleeping on his deck chair, "That entertainer was not a direct employee of Royal Caribbean" will hold exactly zero water in determining liability.
All arguments were complete shite.
To be clear, this isn't part of Magic Kingdom or one of the proper Disney theme parks. This is a shopping area, open to the public without admission.
For a closer scenario: the cruise ship docks at one of its stops for a day. The area around where the ship docks is owned by Royal Caribbean but open to the public. Most of the stores are privately owned and operated, leasing space from Royal Caribbean. One of those stores is a theater that runs a chainsaw juggling show. Royal Caribbean's website/app includes the full schedule of that theater and highlights that show as perfectly-safe-we-assure-you. Your dad attends that show and gets bisected.
The key point here, entirely not captured by your scenario: the theory making Disney plausibly liable is that Disney's own online services presented this restaurant and its menus which made the plaintiff believe that the restaurant was subject to Disney's allergy standards. It is not at all unreasonable to say that EULAs for those online services are relevant to this dispute.