What about trust-based systems. You choose who you trust and get information that they found not to be SEO-garbage, like trust-rings. When the system can't do it alone, user-centric feedback may work. That could give interesting inputs besides the ones Google already gets using its standard metrics.
1. Old domain names bought solely for their old SEO rank.
2. Apps on mobile app stores are sold, and updates begin to include shady privacy-invading malware.
3. Old free software projects on various registries (npm etc.) are sold, with the same result as (2).
Otherwise, it seems really like a cat and mouse game. Another option may be to force SEO to be indistinguishable from the best content. Is that the current goal?
I suspect this is actually one of those fundamentally hard problems.