You don't have to buy links to get a link penalty. You could sell them, you could spam other
blogs, you could do three and four way link exchanges, you could make your own spamblog
network, and most bluntly... you can link to people who do any of the above. Not linking to a bad neighborhood has been the one of the clear suggestions/instructions Google has had for at least five years.