People use nofollow because they believe (rightly or wrongly, none of us know for sure since it's a secret) that if you link to a site that later turns out to be a link farm you can be punished for it because it appears to Google that you are part of the paid links scheme. 'Turns out' meaning either it was a link farm all along and you didn't notice, or didn't think it mattered, or because the site got bought/hacked and now is just a link farm. (I'm using 'link farm' in the broadest possible sense here since I'm not familiar with all the various ways a site can be deemed to be engaging in paid links and I believe there are quite a few and it's intentionally vague).

Even if Google isn't penalising you for that today, they may well tomorrow. So using nofollow seems like quite a rational thing to do for any individual site as there isn't any downside as far as I know, only potential benefits.

Additionally, manually disavowing links hardly seems like a scalable solution. As somebody with a small website that I spend very little time maintaining, I don't want to have to regularly be checking some Google console for 'bad links'that I have to manually disavow to prevent getting delisted.