It's extremely unlikely that the penalty will pass even without using
rel="nofollow", I believe Google has things in place that detects this on a larger scale.
Good Black Hatters will generally never link to their main site, referred to them as their money site. They use chain sites that have lots of spam and normally when these sites get hit they just lose the rankings on siteB but of course this has the knock on effect so effectively they ain't getting the juice they used to because siteB no longer does, simply replacing siteB with another site should put siteA back into good standing because they lost the juice from siteB... too many siteB's and then siteA could face its own penalty (explained at bottom).
Now I mentioned larger scale, it's extremely doubtful and even with my own experiences you won't get hammered when getting linked from a couple of bad neighbors, it takes many. Of course using the nofollow will help to some level but enough nofollow's and it can still get your site penalty.
It's also worth noting that penalty don't pass as you would believe, penalty's only pass on the site with the penalty... so if you had olddomain.com 301ing to newdomain.com then it will pass. Neighbor to neighbor does not, it just effects your link profile and eventually Google will issue it's own penalty against that site.