Unless you work in an incredibly close-knit field where everybody knows everybody else, this is a myth and it needs to stop propagating.
You can choose references from personal friends and co-workers that will stress your positive results. The company as whole will never say anything positive or negative for fear of legal reprisal. If you worked for a bad actor, then burn the bridge and don't worry about retribution via reference checks.
It may depend on the field, yes, but this doesn't reflect what I've seen. From my view, unless you're on the lowest rungs of a monster field like retail, most fields tend to be small, and get smaller the longer you're in, as you're transitioning to being a long-timer. People know each other, and people talk. Even if the company itself will never say anything positive or negative, the people within talk to each other. It's incredibly easy to reach out on 'unofficial channels' to find some bits of information, and suddenly, a promising prospect never pans out. As for legal liability, all you know is that you were never hired; if you're lucky, you get a 'we found a more suitable candidate.' As far as liability is concerned, it's easy to sidestep.
Companies can request references from your last direct manager for example.
This has personally happened to me where the last three direct managers (going back 3 jobs) were requested by a tech company.