> Do search engines (or really just Google) still penalize sites that are pure SPAs on that fact alone?

Google says that they don't. They use an evergreen googlebot, which is the latest (or thereabouts) release of headless Chrome browser; and it waits for the scripts to load and executes them. You can watch Martin Splitt's talk from the recent web.dev live event for the latest updates.

Server-side rendering is still important if you care for other search bots or if you want to share your site's pages on social media (with page preview).