Thing is, there IS one set of rules already - and thats governed by the google organic results algo which looks at a sites backlink profile as a whole.
If its mainly crap links with no authority then the site will get banned. If its a big brand site with authority and reputation, its really tough from Google's perspective to simply ban that site and all its pages because there are some links of questionable authority pointed at it.
IF they did that, the search results would be a pretty lonely place, and it would be super easy to remove sites positioned above yours in the results!
This doesn't justify the spam, it just makes it much more difficult for Google to detect and penalize due to the mostly natural link profile that Expedia has earned legitimately by building a household brand.
If you had 99% signals saying this is a strong brand worth ranking high, or even only 85% of the signals are positive, and you have a few shady backlinks, wouldn't you give them the benefit of the doubt? Even if you wouldn't can you risk penalizing them without a smoking gun and proof of spam?
The only real question here is why Expedia even bothers with these efforts...Most big brands can get more than enough natural backlinks by launching new programs and services and having all the press pick up the story.
I don't think we should accept that same behavior should have different implications depending on who is doing it.