Historically, a large component of Google's ranking algorithm involves the number of links pointing to a website (and a number of other qualities like anchor text, unique domains, surrounding text, etc.). If my memory serves me, there are over 300 ranking factors - but links are still the most important.
By buying links (undetected) you can manipulate the quality and relevancy of your website in Google's eyes and cause it to rank better than it should.
To add to this, the reason they can't penalize you is because then you would just buy links for your competitor. All Google can do is drop value on links when they detect malicious behavior. As such, buying links still largely results in a positive effect on your rankings. Google is starting to focus more on other factors than links though, social signals in particular are becoming a big factor.
I think algorithmically they can only discount links from bad neighborhoods, etc... but if they catch you, they will manually penalize you.
I think we are a ways away from social signals being a "big factor." While google does claim that they look at social signals, I think from a practical standpoint the only value they provide is raising a red flag when someone manipulates social signals like buying likes and plus ones. The same way google looks at a link profile of a site, they can catch a bad social profile that seems unnatural.
Chrome being penalized was a bit of a special case. Google got caught (even though it wasn't directly them) and they gave a harsher punishment to themselves because they claim they hold themselves to a higher standard. The whole thing was really damage control to save their reputation, they already had a lot of scandals this year.
In reality, links are almost never seen as a negative. Which is really a shame, because it makes it harder for good-guy SEO's to legitimately build links when you can just buy 10,000 on Fiverr and not worry about it. And most black-hat SEOs buy links from many players, so even if some are discounted they won't usually still come out on top.
Google is getting better at it though. Recently they've been cracking down on blog networks. This is purely conjecture, but I do believe that links are on their way out as the primary signal.
Apologies, missed a typo: "And most black-hat SEOs buy links from many players, so even if some are discounted they WILL usually still come out on top."
By buying links (undetected) you can manipulate the quality and relevancy of your website in Google's eyes and cause it to rank better than it should.