> someone will dress up their low-value content to appear "high value" to your algorithm
You are falling into the trap of thinking that Google and its competitors are victims of this. They are not.
They are knowingly letting themselves get "exploited" because it turns out that those spam sites contain ads (that may be Google's) or analytics (that may be Google's), or make the search result page ads (from Google) look good in comparison and more likely to be clicked.
The heuristic to detect and block spam in general is very simple. Spam is there to get you to either buy something (the signal is the presence of a credit card form, "buy" call to action, or links that ultimately lead to the former) or view ads (signal there is presence of ads).
This would be very hard to game because those signals only work when they are visible (and obnoxious), which also makes them trivially detectable purely at the visual level by a crude classifier (trained on website screenshots with ads vs the same page with an ad blocker).
The resulting penalty score can be used as a ranking signal, so that all other signals being equal, a result without ads would rank higher than the one with ads for a given query.
This is not rocket science. The problem is that the mainstream search engines have the same business model as the spammers (and profit off each other), so there is no reason to suddenly slaughter the cash cow. The myth that search engines are "victims" to spammers/SEO provides very convenient plausible deniability so they have no reason to disprove that either.