The larger ice grains in the plumes came directly from the water of the sub-ice ocean. Those grains were not condensed to solid particles from the cooling of water vapor flowing up the fissures in the ice, called "Tiger Stripes" by the Cassini team. Such condensation would make the particles essentially pure water ice, since the salt doesn't evaporate in any significant quantity from the ocean water.
Instead, according to Dennis Matson and colleagues on the Cassini mission, it appears that at the ocean "surface" inside the fissures, chambers, and other subsurface "plumbing" of the tiger stripe systems, bursting bubbles eject small droplets of ocean water into the outflowing water vapor. Those droplets freeze, carrying the salt content with them, along with the other constituents in the ocean water. The bubbles originate from carbonate dissolved in the water. As fresh ocean water rises into the fissures the hydrostatic pressure decreases, and like soda in a just-opened bottle or can, the carbonate produces CO2 gas that comes bubbling out.
To explain the most energetic particles emanating from the vents, Matson et al propose that near-surface chambers in the ice, fed directly by ocean water percolating upward from beneath, occasionally have their vents to the surface plugged or narrowed, allowing pressure to build. When the obstruction or constriction clears, the chamber vents to the surface at a higher pressure (and mass flow rate per vent aperture area) than it would if coming directly from an unrestricted crack. Research by Francis Nimmo of UC Santa Cruz shows that tidal flexure of the ice crust at the south pole occurs almost constantly, providing a mechanism for clearing obstructions in the fissures. Though sequestered in the chambers, at least temporarily, the water there comes directly (via the plumbing) from the ocean and has the same composition as the ocean.
But research by Jürgen Schmidt, formerly of the University of Potsdam in Germany but now at the University of Oulu in Finland, concludes that at least some of the larger, salt-containing grains can originate without the chamber mechanism. If the water is at or near 273 K, the vapor pressure of water is sufficient to establish an upward flow that can carry the particles to the surface and out. Remember, this is exhausting to a vacuum, so it doesn't take a lot of pressure to get high flow velocities. Cassini investigations with the Ultraviolet Spectrometer (unfortunately behind a paywall) found the gas outflow speeds in the plumes to be supersonic, at 600-1200 m/s. The vents are acting like rocket nozzles!
One of the problems the carbonate scenario solves is how to get water from the ocean, beneath anywhere from a few to tens of km of ice crust, close enough to the surface that the exuded water vapor doesn't recondense on the walls of the fissures. As alluded to in the question, liquid water is denser than ice, so to maintain hydrostatic equilibrium, the water coming up a hole or fissure in the ice shouldn't reach the surface. The thicker the ice layer, the farther from the surface the water will reach. But if something makes the bulk density of the water equal to that of the ice, it can indeed reach the surface. CO2 bubbles in the water can do exactly that.
In accord with these theories of how the different particles are produced in the plumes, the Cassini dust instrument and mass spectrometer instrument found that the larger grains (~10 micron diameter and larger) are salty, and the smaller ones (less than ~1 micron) are nearly pure water ice, consistent with condensation from the outflowing water vapor.
Another intriguing component of the plumes is nanosilicates, silica particles a few nanometers in size. Research indicates that these can form only when hot water with silica dissolved in it is quenched by much colder water, exactly the situation in a hydrothermal vent. The conclusion is that there could be hydrothermal vents on the seafloor of Enceladus. Earth's oceans have plenty of these, mostly along oceanic rift zones. Despite their great depth that cuts off all sunlight, these areas teem with life, and not just microbes: tubeworms, crabs, shrimp; all feeding off nutrients and warmth carried in the hydrothermal water.
The astrobiologists are champing at the bit to go back to Enceladus's plumes. Cassini's mass spectrometer could measure molecules of mass only up to 100 mass units (formerly Daltons, before that AMU; who knows what the next "unit du jour" will be?), so simple molecules: H2O, CO, CO2, NH3, CH4, etc. (all those were found in the plumes! C, H, N, O—the Big Four of biological constituents!). We need instruments there that can detect such things as amino acids, and fatty acids that are the building blocks of membranes, possibly microscopes to see individual cells, before we can say anything definitive about life in the Enceladean ocean.