Yes, I once made a bug report based to a client's supplier (overly permissive API endpoint was leading user data) and became the subject of the a spurious defamation letter. It was obviously unwinnable on the supplier's part, never went past solicitor's letters, and still cost high four figures to defend.
Nothing like some of the real horror stories, but still a significant chilling effect.
Nothing like some of the real horror stories, but still a significant chilling effect.