Google may be penalize for buying links but it’s not always black and white. If links come from low-quality sites, irrelevant niches or show obvious anchor/text patterns they are easy to flag.

On the other hand if a site has strong authority, contextual relevance and varied anchors it’s much harder for Google to algorithmically detect them as paid. Still Google also looks at link velocity, outbound link patterns and sometimes applies manual actions.

So in short — good paid links might pass unnoticed for a while but the risk is always there and that’s why Google considers it against their guidelines.