Yeah but isn't it a criminal act to poison

"Poison" implies someone deliberately intended to cause harm. Nothing has been presented to argue that someone deliberately intended harm.

I mean, if I was allergic, I wouldn't trust the restaurant either,

Exactly. This is what a reasonable, prudent person would do. If the customer had checked their order, they would have discovered the problem before any harm arose.

Which is why this guy's health insurance should simply cover this: simple negligence by the insured is not a valid justification for denying coverage.

It would be different if we were talking about something that the customer couldn't have verified. But the presence or absence of onions topping a burger is easily verified before consumption; the customer was not reliant on the restaurant to ensure their own safety. They had the ability to prevent this particular harm through a simple, reasonable action that they failed to perform.

IMO, that means their liability here is the cost of the burger. They would have been expected to replace the burger if the customer had checked.

But the real takeaway here is Fuck Health Insurance. If this is, indeed, subrogation as I suspect, we should be picketing an insurance executive.