They can reduce or plain not pay your bonus, yeah. But making the employee pay for "damages", even by subtracting them from remaining pay or bonuses, is very very illegal.
The problem is these companies are comfortable with this level of illegal, because they're multiplying potential fines by the odds the employee will actually go to the authorities, and then weighing that against the exploitation benefits multiplied by their whole workforce.