There are a few states where it is actually illegal to say more than dates, salary, and title. I think Michigan is one of them? Beyond those few states, you are right, it's not illegal but they open themselves up to liability if they reveal something that is perceived to be untrue. Even if it isn't untrue, there's the possibility of a lawsuit, so most just don't say a thing.
And yes, there's always back channels that employers can use. Most industries are really fairly small and incestuous so employers often have sources they can rely on to provide unofficial information. Someone they used to work with that worked with you, someone they went to school with, someone they know who knows someone who worked with you......And its pretty rare that you will ever find out who they talked to about you or what that person said.