The line is defined by Google's spam policies, not by taste: buying links, cloaking, doorway pages, scaled content abuse and expired-domain abuse are named violations. Some of them work for a while, which is exactly what makes them tempting, and the asymmetry is what makes them a bad trade for an operating business — the upside is a ranking you could earn another way, the downside is a manual action and months of cleanup.
The useful question for a buyer is not which hat a provider claims to wear but what happens if a tactic stops working. Ask where links come from, whether content is disclosed as AI-assisted, and what the recovery plan is. A provider who cannot answer those without discomfort is telling you something.