That is the standard answer and it is only half the story. Two completely different things kill a tactic, and the risk profile is nothing alike.
The first kind just stops paying. Google quietly stops counting the signal. Nobody gets caught, nothing lands in Search Console, the tactic simply stops moving anything. Article directories, sitewide footer links, comment blasts. The links still exist. They just buy you nothing, which is why people keep selling them.
The second kind gets written down, and then enforced by hand. That is the more interesting story and it is recent.
March 2024, Google added two brand new sections to the spam policies: expired domain abuse and site reputation abuse. Same update renamed spammy auto-generated content to scaled content abuse. Three tactics that had run for years went from grey to explicitly named. Then November 2024 they tightened site reputation abuse so that first party involvement or editorial oversight no longer gets you out of it, which closed the "but we have a real editor on it" loophole half the big publishers were sitting behind.
Here is the part nobody mentions though. Site reputation abuse is still enforced by manual actions. Sullivan has confirmed it never went algorithmic. And the June 2026 spam update, which ran 24 to 26 June, explicitly did not target it.
So parasite SEO did not lose its power. It lost its safety. The mechanics work about as well as they did in 2023, right up until a human at Google looks at you, and then you lose whole sections of the site rather than a few positions.
That difference is the real answer to your question. Tactics that die quietly are dead and you can stop paying for them. Tactics that get named in policy are very much alive and will take your leg off. Most people file both under "Google got smarter" and never notice they are different bets.