improving alexa means getting traffic, and getting traffic (even off Fiverr) doesn't always have to come from bots. I purchased traffic off Fiverr last year for one of my websites and it didn't penalize me. Well, it didn't help too much, either because that traffic has not converted into a single ebook sale, but my website is still indexed in google to this very day. It had boosted a couple of my low competition keywords a little (moved them from pages 6-8 to page 2), but after the traffic had run out the keywords have gone back to their initial spots (on pages 6-8).
But I spent a good several hours browsing through the traffic gigs, and I probably got lucky cause I found someone who appeared to know what they were doing and has given me "quality" fake traffic if I dare say so. It was a Dutch girl / lady / whatever, but I don't recommend her because it took her 2 weeks to start my campaign, and only after I threatened to ask for refund and report her (more like a scare tactic, because I wouldn't have reported her anywhere, nor would it have helped anyone to be honest). So yeah, after 2 weeks of being constantly postponed for various reasons she had finally started my campaign and the traffic had seemed pretty legit (random metrics, good session time and pages per visit, all that mumbo-jumbo that google cares about).
But this has been almost an year ago (aug-sep 2020), so I'm not sure if this still works or not, but I dare assume that it does because, think about it. If you give your URL to someone to post it on their social media accounts for $5 do you really think google will penalize you for this? If they were doing this then all links posted on social media would immediately get penalized, which is so retarded!
But that's only the social media part. I have also received traffic from google, and regarding google traffic I have no idea how she had done it. But again, it hadn't penalized my website, so I'm ok with that