They are penalising you, the links you've paid for are effectively worthless so you've wasted your money.
Think of it from this angle....
I want to blow my competitor out of the water, i don't like them or their rankings.
It would be so easy for me to go and buy say 50 paid links to their site, leave a visable trace and then report them to Google, getting their site penalised in the process.
Its very difficult for a 3rd party to do anything to damage another sites rankings / reputation in the search engins.