You can be sued for anything, or nothing. You might be able to "easily" win the case, which may still cost you resources that you may not want to expend, and you won't be reimbursed for the stress and time used, only the financial expenses (and even that isn't true in all jurisdictions).

That said, if you know the legal situation, demonstrating that you're not afraid of the legal threats is often the way to make them go away.

For security research, if the goal of the legal threat is to prevent you from publishing your results for the first time... publishing the results can significantly reduce the incentive to cause you further trouble because the goal is no longer achievable.