Yeah their is risk involved for sure, I would proceed with caution, many people on black hat sites are hitting them hard at the moment from what I have been seeing and reading over the past few months.
It depends what level the site has been hit, also if the site penalty is Algo or Manual penalty.
For example:
Level 3: The link profile has been hit with 10 years of black hat (may be near impossible to fix this) 80-100% damaged website, I saw a site like this recently.
Level 2: The link profile might have 30-80% low quality links.
Level 1: The website has 1-30% low quality links (would be a good pick up)
With any purchase you would need to do your analysis on the website, you would really need to dig into the link profile both fresh and historic to see what has happened.
To answer the original question I would buy level 1 sites and possibly level 2 depending on how damaged the site is, level 3 probably not.