That's right. The rejected candidate can always sue. S/he might not win, but s/he can sue.

And for the employer, win or lose, it's a huge headache, risk and cost, with big PR downside to boot. The employer has no incentive to increase this risk by saying more than is absolutely necessary.