The only thing search engines can do to stop SEO spam is to avoid giving any weight to spammy links.
Suppose that the natural situation, with no SEO at all, is that you have the #1 site on some keyword, and your competitor has a lower ranking.
With "positive" SEO, okay, your competitor might have paid a lot of money and bumped you to the #2 site, and that might be frustrating -- but you're still #2!
With "negative" SEO, your competitor pays a lot of money and now you're #100. And that sucks more for you.
Probably not important in the really big keywords where all the top sites have always paid big money for SEO -- then, sure, it's all just relative. But in the relative backwaters where lots of sites aren't engaging in SEO at all, having negative techniques work is a lot more frustrating to the people who just don't want to play the game.
That didn't work before. Zero weight for spammy links is gamed by spammers by spamming everything at full blast. There was no downside for them. There are better dials and switches than falling back to a known broken model.
With penalties in place spammers need to get those existing bad links removed for their own sites / or build from scratch new sites with clean link profiles (which they are doing anyway, slash and burn). Now they will need to multiply their efforts to negatively target sites above them (not just rank one site, but unrank several sites). Good luck doing that without leaving a detectable fingerprint/trace.
The history of when links are created - that will leave a clear beacon that a site has been targeted. Unless a spammer does it very slowly over the course of years. In which case, LOL.
Don't you think it would be noticeable that a site ranking well, with a clean back link profile suddenly starts attracting heaps and heaps of bad spammy links? That's a clear indication something is going on.
The better time to use negative SEO is when the spammer has already gotten ahead of his competitor. Then the influx of bad links might look like an effort to regain rankings. That would be more interesting.
Which only requires perfect spam link analysis /s (or no ability to rank sites).
That system isn't exploitable to sabotage another site's rank, but it also doesn't work at preventing link farms (as evidenced by most Google results before the recent change).
Basically fight source of bad links, not recipients.