It's not a law, it's who handles the request. There's two types of employees in any company with very different KPIs. The first has their performance measured in number of tickets closed. The second has their performance measured in number of incidents allowed. Support tickets get handled by the first type of employee, anything that's plausibly a legal threat gets handled by the second.

The easiest way to close a ticket is a quick wontfix. The easiest way to avoid a possible six-figure minimum legal issue is to spend 15 minutes figuring out what they want and giving it to them. The law is almost entirely irrelevant; the cost-benefit analysis doesn't change enough when comparing a frivolous vs meritorious lawsuit.