From what I've gathered negative-seo isn't realy, google knows that people will start weaponizing shit links to kill competition, I believe google only evaluates quality/real links and if they see you start "stacking" lots of them, then they get suspicious, but if you get millions of backlinks from some spammy source, google just completely ignores those from their equation.
You can disavow them if you're still concerned, but my sites get random backlinks from random spammy sources, especially "directories" and SEO-Agencies trying to sell something through mass-linking to every site they can find.