From a legal liability standpoint, they don't really even have to back it up. If a former employee sues them for defamation it would be on that employee to prove what they said was false. But most will just sidestep the minefield entirely by not even bothering to share more than basic info because even a frivolous lawsuit they can slap down quickly is still an annoyance and an expense.