https://support.google.com/webmasters/answer/66356?hl=en
Also you are mixing things up. You asked what is safe for white hat sites. Not what is working now for sites.
OBL Count is not equal to Spam Signal - Yes
In this age of AI, google's system can easily identify which website is for which purpose.
Spam (casino/hacked pages) still ranks sometimes :
because of churn-and-burn tactics,
Serious PBNs have a maximum of at least 20 OBLs - Google can easily identify link graph and pattern. So it can differentiate between a pbn and a real site.
Hacked pages are ranked because they already have high authority from that legit domain. They eventually get cleaned and deindexed once google finds the exploit.
When we are working for white hat sites, we don't ask the question "Can it rank?”. We ask “Can it survive 2–3 core updates?”