Now still possible, but definitely not as effective – Google ignores most of spammy backlinks now, so regular "spambastic" negative SEO doesn't impact your rankings much anymor
The most recent real-life situations involve hacks, spoofed Google Searh Console actions, or even poisoning/indexing problems rather than spammy links causing any damage
The best way to protect yourself is simple hygiene – monitor Google Searh Console for suspicious links, setup alets, secure your site, and disavow oly when somthing looks fishy