What is Fair?
To begin with, Google can certainly penalize any sites performance within it's own search engine for what it feels is unacceptable behavior in particular with respect to their ability to earn money as a business. This is their right. It is their property. You do not have to participate in their services and by doing so, they have the right to require that you accept terms of conditions as a price for services for which being listed in their search engine certainly is. This is all legitimate, above board, fair, and common practice for all websites and especially for search engines.
Fair is fair. Google expects you to behave in reasonable manner and not to try and manipulate search results. This is fair for all who use the services, and especially fair to Google who is providing a service as part of their business model in which their bottom line can be effected. Google strives, whether you agree or not does not matter, to provide the best possible user experience for their customers both the search customer and website owner. In this, there is dependency upon the participants to conduct themselves in a manner that befits the society that is the World Wide Web with it's established rules of fair play.
What does Google say about links in their quality guidelines?
As a part of their conditions, Google publishes their quality guidelines which they expect you to adhere to for participation. In that quality guideline, found here, https://support.google.com/webmasters/answer/35769?hl=en and here as a Q&A https://support.google.com/webmasters/topic/6001971?hl=en&ref_topic=6001981, Google states the following (from the second link which is more verbose):
The following are examples of link schemes which can negatively impact
a site's ranking in search results:
Buying or selling links that pass PageRank. This includes exchanging
money for links, or posts that contain links; exchanging goods or
services for links; or sending someone a “free” product in exchange
for them writing about it and including a link
Additionally, creating links that weren’t editorially placed or
vouched for by the site’s owner on a page, otherwise known as
Low-quality directory or bookmark site links
There is much more in the guidelines that you should be aware of.
There are two general forms of penalties; manual and algorithmic.
Manual penalties begin with algorithmic computations that trip a trigger for a manual review. A manual penalty is a review by a human after the system has determined that you may deserve a manual penalty. People often see this as the harshest of the penalties because it also requires a manual review to remove the penalty.
However, what is more insidious is the penalty made purely through algorithmic means. You will almost never know it exists and what you can do about it. Manual penalty aside, any other penalty, while it does not take a manual review to remove, is a far slower recovery being fully dependent upon Google discovering and processing any changes that have been made which is not a fast process.
Google is not stupid.
Most links networks can be easily detected through standard AI (artificial intelligence) pattern recognition schemas. In addition, Google has dedicated nearly a decade to evaluating link schemes and creating manual pattern recognition teaching rules that their AI process can use. As more patterns are recognized, computer learning comes more into play. Google is very good at recognizing link patterns.
As well, Google has been using semantics to evaluate content, links, and other elements and is able to determine natural language from computer generated language even if the computer language was originally created by a human. How this is done is based upon science that has existed for many decades. Even in semantics, links will follow patterns and give themselves away easily.
Buying links does not mean that a human is making links.
Link services go for the low hanging fruit that is automated. In your question Is it worthwhile to pay for boosting SEO for a new wesite?, I answered and here is an important quote:
How this part of the so-called SEO industry works is trading in bulk
work. This is done by reducing labor costs with automation. These
sites will bulk submit your site to search engines, directories, and
other link friendly based sites. As well, many operate a link
authority scheme where a super authority site and several other
authority sites intentionally built to manipulate rank and not
designed for people. These site will create a link to your site for a
price. Anything done by a person is often done by a fairly
disreputable person living overseas in India or in Asia. Any link made
by a person is barely acceptable if at all and not made with your
interest in mind.
I will add this.
A well know online article was written by a Google spammer. Confessions of a Google Spammer by Jeff Deutsch found here https://inbound.org/blog/confessions-of-a-google-spammer. In this and other works, it is discussed how the building of link schemes and super authority sites and how paid links work. One of the key aspects of the scheme is that any link can be easily removed and are generally leased on a monthly basis or held ransom. This is a major part of the link buying industry. As soon as you stop paying for services or more services, the company can quickly remove the links you are dependent upon taking you back to where you were before. Nowhere. And with less money.
Here are some link networks articles. I could have easily dug up many more. My point is that Google is seeking and destroying link networks which you may be a part of if you purchase links.
Google Has Penalized A Link Network In Japan
Google May Have Penalized Another Underground Link Network
Confirmed: Google Capital-Backed Thumbtack Hit With Manual Action For Unnatural Links
Google Takes Action On More Link Networks In Poland
Google Hits Poland Again With Link Network Penalties
Google Targets Two European Link Networks
Google Takes Down 7 Japanese Link Networks
And let us not forget J.C. Penny.
New York Times Exposes J.C. Penney Link Scheme That Causes Plummeting Rankings in Google
Where J.C. Penny paid a well known SEO company, SearchDex, to build links and promote their site. Google penalized J.C. Penny by delisting the site for a fairly long time even after the problem was corrected.
Link buying means the wrong links.
Of the links you will likely be purchasing, the following are penalized by Google. This list is partially taken from: https://blog.monitorbacklinks.com/seo/types-backlinks-violating-googles-guideliness/ The explanations are mine.
These are networks of blogs controlled by a single entity or series of entities for the purpose of building authority. It is a more modern equivalent of a link network.
This is precisely what killed J.C. Penny.
No explanation required.
Article Promotion Sites
Generally low quality guest posting.
No explanation required.
A favorite place for automated paid links to appear.
A favorite place for automated paid links to appear.
Backlinks from websites with duplicate and spinned/spun content
General Low Quality Links
Automated links are often low quality for a variety of reasons to include low semantic value, use of spam keywords, topical irrelevance; and placed in headers, footers, sidebars, or below content.
Niche Search Engines
While this is not on the list from the linked page, paid links are often from sites being submitted to niche search engines. A favorite place for automated paid links to appear.
Also not found in the linked list. Links particularly within post signatures, however, links can appear between posts.
Also not found in the linked list. Google has made a lot of effort to analyze comments within a comment section for spam.
What does Google say about inbound (back) links?
Google's John Mueller is quoted in this article entitled Google: Try To Avoid Link Building Because It Can Do More Harm Than Good found here http://searchengineland.com/google-try-avoid-link-building-can-harm-good-214861. When asked, “is link building in any way good?”, John responded with the following:
In general, I’d try to avoid that.
So that you are really sure that your content kind of stands on its
own and make it possible for other people of course to link to your
content. Make it easy, maybe, put a little widget on your page, if you
like this, this is how you can link to it. Make sure that the URLs on
your web site are easy to copy and paste. All of those things make it
a little bit easier.
We do use links as part of our algorithm but we use lots and lots of
other factors as well. So only focusing on links is probably going to
cause more problems for your web site that actually helps.
The upshot is this.
Link building is necessary. Paying to build links is a waste of money primarily because the quality of what you will receive will be discounted heavily.
Google and spammers have been at this a very long time. Do not tread in these waters.
In particular, you should be in control of how your site is represented and found. You do not want to pay someone to exercise that level of control over your sites future. Paid link schemes are just that - schemes. It is like saying this unlicensed doctor seems okay - should I use him? There is no legitimate link purchasing outlet. None that Google, Bing, and others will appreciate. None. Full stop.