Because they tell us:
https://support.google.com/webmasters/answer/2648487?hl=en
>How does one determine their site is "punished"?
Because it suddenly falls behind in results?
Without a real way to understand what's actually going on, you're just shooting at the darkness. It feels more like worshiping a cargo cult than doing something actually productive.
That's no more a reason to doubt spam links' effect than to doubt any other suspected metric, as all as "shooting in the darkness".
What are you gonna do, lie down and have the site end up as low as it can get? Sometimes you do need to fight in the dark, and gauge any changes you make from the reaction you get.
"I'm never going to say to myself "welp, our pagerank went down, time to use Google's weird tool to clean up the negative SEO attack again."" -- is not really an option.
I have seen the consequences of paying for SEO. They spam your site URL on random web forums. If you pay for SEO, you are very likely paying people to use bots and sweatshops to spam your site url via low quality garbage links dumped on Twitter, on web site hosts, in comment sections and forums. A lot of this traffic originates from criminal botnets. Seriously, don't do it.
As an example I just pulled out of our filter, here's what you're really paying for when you pay for SEO: https://twitter.com/karenhall191
Unfortunately, as a web hosting provider (neocities.org), I have to deal with some of the fallout from this. Google's business model creates this problem, but they provide little support and few tools to help us deal with it (reporting API please?), and we're largely forced to go it alone.