You could be penaltized for buying links, but not because you bought them, but because you bought them from the wrong website.
I spend thousands a month on text links and it's nothing but a form of advertising. But I always research the website in dept before buying - I have seen websites with PR8 selling links, but neither the PR8 website, nor the websites they link to could be found on Google.
I agree with WebFusion that it doesnt make sence to penaltize a website for buying links, however Google obiously does sometimes. I guess if the website which is selling the links has been penaltized for something, and then Google finds that all pages of that website link to another website - it will penaltize it as well. Makes perfect sence to me. ROS links are like "the ultimate endorssment".
So just do your research people - see if the website is ranking on Google, see how the text links have affected other advertisers on that website, and go from there.
If you think the traffic will be great, but the website might have a penalty - buy a domain name, use it just for text links and then forward that domain name to your website.
With market like the current, when everybody is selling text links - you have plenty of choices.