Google has made it quite clear that you are responsible your site and it's marketing. If you use an outsourced/3rd party that breach the guidelines - your site/rankings are still liable to be impacted.
That is regardless of whether "you" personally intended the breach or not.+Alireza Sefati
Going back to intent - how is Google meant to know the difference between your paid review and editorial link, and a paid link within content?
I'll be fair here (Google employees pick yourselves up) ... it is an incredibly difficult task.
There is real intentional spam, there is unintentional spam, there is misguided spam, there is slightly over-optimized and looking a little like spam ........ and they have to draw the line somewhere.
Lets not forget that some of these guidelines are "old" and have been around for what, nigh 10 years or so (this month?) - so cover from a time that was very different.
So they have to draw that line - and stick to it.
They move it over time ... cover new things, use more data ... make the liner finer/better ... but it's still a lot of "grey" in there to deal with at times.
G have to be seen to be following their own rules.
They have to be seen to take it more seriously than any other.
They have to ensure that they don't damage the trust/faith that people have in them.
So they have taken this action.
Tehre is also the possibility that they are milking it for publicity, attempting to endear themselves further, show that they are whiter than white, warn off otehrs about buying links (accidental or otherwise) etc.