If Lighthouse is warning about dom size that may result in performance issues which can effect the sites rating because of the algo on performance. Can you use a progressive method to get the testimonies via a json request? which allows the page to begin rendering and then updates the page, (fills in the testimonials).
Lets first define penalty because not everything is a penalty
There are algo related ranking issues and manual action penalties. And they are not the same thing. If one is talking about the actual spamy content penalty that would be an actual manual action penalty.
Google does show a manual action penalty in the search engine console.
https://support.google.com/webmasters/answer/9044175?hl=en
What is a manual action?
Google issues a manual action against a site when a human reviewer at
Google has determined that pages on the site are not compliant with
Google's webmaster quality guidelines. Most manual actions address
attempts to manipulate our search index. Most issues reported here
will result in pages or sites being ranked lower or omitted from
search results without any visual indication to the user.
A manual penalty would normally be materials that is not filtered by the algo
https://developers.google.com/search/docs/advanced/guidelines/report-spam
And Google does discuss hidden content, the what is hidden is hidden, (I jest), in a summary drop down under the List of manual actions.
https://support.google.com/webmasters/answer/9044175?hl=en#zippy=%2Chidden-text-andor-keyword-stuffing
And, provides a process to unspam your site and humbly apologize for crossing the line.
We also need to define deep content vs hidden content
Hidden content would be content that the search engine sees but the user does not see. Deep content would be materials that the user can see but the search engine can not see.
Since the value of an input tag with type hidden is generally not indexed by search engines, I believe the question is really is there a deep content penalty, IE is it cloaking!
update additional information per questions in comments.
No as cloaking is well defined as using redirects ect that remove
source code from the view of the robot.
Deep content being materials that are not specifically removed but not
followed by robots ... IE check box if you are a human to reveal a
coupon for a discount.
Would be accepted deep content.
Having data in graphics would be material that is not index-able by
search engines and thus deep content but not "hidden" in any way such
that is would be cloaking.
Usage of a paywall for subscripters would be deep-content. It not visible
to google but also not indexed, nor not indexed because of a penalty.
Objectionable hidden content.
As a actual spammy site penalty would be given by a review of the site by a human, it is not directly answerable. Other than asking co-workers to look at the site and decide if it looks spammy to them.
If this were the source code I would say it is spammy do to hidden text:
<meta name="description" content="Worlds best photo of a flower">
<div style="display:hidden">Worlds best photo of a flower</div>
<img src="1234.jpg">
and change it to:
<meta name="description" content="Worlds best photo of a flower">
<img src="1234.jpg" alt="Worlds best photo of a flower">
If I were working at Google I would not have the heart to give the person in this example a penalty because I can understand what he is trying to do. But then again if I were racing through links that have been reported, I may not have the time to see the intent and realize its just a person who does not know what he is doing; And, needs an email to tell him he is not doing it right.
So the person reviewing the content may have his own definition! !! !!! !!!!
Because there is no definitive line its best not to approach the line and fall into the space of questionable content. This works in Google interest so they will not clearly define "hidden content" so people can not claim a technicality. No technicality exists!
Cloaking, materials hidden from search but visible to people.
Generally what this is referring to materials that are not given in the source received by google. IE the webhost is presenting a completely different page based on the IP address to Google while hijacking IP address from other sources and presenting a entirely different page.
In this case its not cloaking, the materials are visible. If google is not indexing the material then it is deep content. Although might be objection if the content is malicious.
Google detects cloaking by using IP addresses which look like they are users not coming from Google and compares what it received.