> any more than amazon is "shady" for allowing to post false/defamatory reviews.

Amazon attaches identifiers to reviews, and you could ultimately file a defamation suit and subpoena their identity. With Experian you don't even know you're being defamed.

> is this something that actually happened, or something theoretical?

There's no way to know from the outside. Even if Experian hasn't done this yet, they've set up their system so that they have the capacity to do so.