Do you have evidence of this actually happening?

I wouldn't be surprised if vendors had language in their agreements that prevented them from getting sued (such as forced arbitration). And because there's no transparency with closed source software the vendor could try to keep it quiet. If it's b2b software that would be easier than you think because both the vendor and client have incentives to keep it as quiet as possible.

The vendor obviously doesn't want to disclose the issue because it makes them look bad. But it would also make their clients look bad, since customers may believe the company or any data they provided to them is compromised as well, regardless of how much truth there is to that.

The smaller and more B2B focused the vendor and clients are the more likely it is they will be able to and incentivized to sweep it under the rug.