If 1 in 1000 candidates would sue you, causing $100k in costs for a drawn-out legal battle, then your practice has a very expensive expected value, but in a way you won't notice until shit hits the proverbial fan.
And each of them tell all their friends that you are an a-hole, then when every potential hire in Cambridge/ NYC/ Stanford etc has heard that XYZ software are a-holes you are going to have one hell of a job hiring.
If you are a small startup in a high tech hub trying to attract people, and especially if you are in a market where the programers you reject might be future customers then you're risk is different.
Companies often forget that the people they reject don't disappear. It used to be a big thing in merchant banks in the last boom to really grind and humiliate candidates - you aren't smart enough to work here etc. What they forgot is that those people went to work for companies that might need a merchant bank and that the victim is suddenly the customer.
Plus, if the 1 developer you DO hire continuously tells people it's a great company working on cool stuff, that would outweigh the negative comments from the other 99.
If this process makes it more likely that good candidates got in touch with you, you might actually save money.