Large media buys are usually bought directly from a site, via insertion order. Which is basically just a contract.
But media buying is just a broad term for buying display ads (i.e. banners) on sites. Paying for impressions, a certain length of time, or even ppc, it's all media buying.
The thing is, you pay upfront. For example sitescout requires a $500 deposit first. Buyads.com is another example where you can view the sites in their inventory, select how much traffic you want, then pay for it. Kinda like a shop for traffic.