Building/paying for any link is considered BH as per Google guidelines,
Now, building links is not necessarily risky if you're doing it right,
You won't get penalized or negatively affected if you're building the right links,
If you're paying for guest posts within genuine authority niche-relevant websites, they'll do the work for years without any problem,
The same for PBNs, if you're getting clean ones, building genuinely looking websites with good content, design, & overall on-page, with low OBLs,
The major point is to focus in building "quality" links, these have little to no chance of getting detected as bad/low-quality links,
So, the risk involve more about leaning into "spam" rather than BH,
Most importantly, links from link farms, auto-generated on random websites, that won't work in the first place or will get you doomed anytime in the future,
The same goes for poorly built PBNs, the ones built using weak domains, poor content/design, not taking care of any of the website on-page,
As well as guest posts within small/low-authority or/and general websites, these could work, but could be taken down anytime,
These are less risky, many kept working for years despite the recent changes of the algo, but don't be surprised if they get doomed