As far as I understand, companies in the US really don't like actual litigation due to discovery: They'd be required to provide documents relevant to the case i

As far as I understand, companies in the US really don't like actual litigation due to discovery: They'd be required to provide documents relevant to the case if requested. This not only risks making embarrassing documents part of the public record, but is also incredibly expensive since their lawyers have to review all the documents, and it can be a lot - and they generally can't recoup those fees. If they really want you to stop, e.g. because you're putting their core business at risk, they might consider it, of course. But they won't do it for random bullshit. They do have infinite resources to crush you - but even they don't have enough resources to do it to everyone who ignores their C&D. Also, I would expect the likelihood of getting sued (by a company that's acting rationally - small businesses where you've personally pissed off the owner can be different) depends on whether they can achieve their goal. If for example their goal is to keep you from publishing details about a security vulnerability and public embarrassment, the motivation to sue you is likely to go down once the vulnerability is public and their behavior has been reported in the tech press, and continuing to press it will just continue to the Streisand effect.