You could potentially host an spa on s3 which hits an api. In that situation the spa would still be indexable. And I dont think google removes you from the index, but spam coming from the same ip seems to be a negative criteria.
Is it negative criteria though? It seems to me that with shared hosting the situation would be so common that it would seem to be big false positive metric. Granted, it’s a couple of years ago and things maybe have changed, but here’s Matt Cutts saying that it doesn’t (for that reason) https://youtu.be/4peSUa2FKvk
I think this is the danger of the SEO industry. On the one hand you have bad actors trying to game the system, but on the other, people selling you legitimate SEO are often claiming rules as fact with little or no evidence - because it’s different to verify.
