That's idiotic. If spam links counted for 0 (when caught) there would be no disincentive for everyone to use them. The appropriate way is for them to count negative but have some way of legitimate sites disavowing them at some kind of time or effort cost (oh wait, that's what the system currently is).
There's a huge number of replicated Chinese spam sites (xyz123.com, xyz456.com, mob123.com) that link to my site. I don't know why or when they started linking to my site, but I know that i didn't have anything to do with it. Your position seems to be that it's legitimate that I'm penalized for this. It's hard not to take this issue personally. It's like being falsely accused of a crime and having to pay a fine.
Is the disavow tool not available to those who tried to use spam links and got caught? I suspect the opposite actually. Those who automate link creation, also automate link disavowing. So the spam links probably have more penalizing effect on the innocent.
Still probably the right trade-off from GOOG's perspective, as long as black hat SEO has bigger negative effect on relevance than negative SEO.
If you have a better system let's hear it.