Yes - this does happen.

[1] https://www.cnet.com/news/dutch-chipmaker-sues-to-silence-se...

[2] http://www.eweek.com/blogs/security-watch/german-software-co...

[3] http://www.securityfocus.com/news/11259

[0] https://duckduckgo.com/?q=security+researcher+sued&t=ffsb&ia...