And if they don't penalize for it, then it's a 0-risk proposition to try buying thousands of links just in case a few of them sneak by and boost your rank. What do you have to lose?
But like you said, Google doesn't know who paid for them, so if they penalize spam links you can use that against competitors. There's no good solution other than "Be 100% perfect at identifying and ignoring fake links."
I actually think one of the things that stops competitors from buying poor quality links, is the fear that it might have the opposite effect. Google simply can't keep up with the spam that is created - so they are forced to take a moderate approach.
But like you said, Google doesn't know who paid for them, so if they penalize spam links you can use that against competitors. There's no good solution other than "Be 100% perfect at identifying and ignoring fake links."