Interesting case. I do have a website thats more then 10 years old and which belongs to one of my clients. He got struck by the typical wordpress comment spam, in short there where over 50k of comment links found in barely months, and that counter is still going up since google is'nt so fast in crawling half of the internet (yet).
It is true that google pretty much senses if something evil or phishy is going on. I was suprised that even with 10k of follow links with the worst (same) anchor all over the place left the ranking(s) pretty much in tact. But there's good tools like https://websiteseochecker.com/extract-url-to-domain/#arearesult for example where you could cram in dozen of links and simply get ONE url out of it instead of weaving through a thousands of URL's manually.
This made it pretty easy to finally cram all those links in disavow. Yes some do hurt; usually after a half day when i submitted a disavow list rankings became a bit better. But if your spammed with low quality keywords, pages and all that, and you did'nt had anything with it or it was the 'leftover' from another SEO company, it's good to manually put these in disavow and measure the performance of your website. Sometimes it can take up to 2 weeks even, so have a bit of patient.