In a word: ignorance. In general, SEO firms advertise themselves on the basis of getting results. Customers usually don't ask in detail how SEO is performed and aren't worried about the dangers of trying to game Google's algorithm. Even when companies are aware of what "blackhat SEO" is, they don't really know what to look for.
I once found myself at a Fortune 500 company explaining to a group of 20 people talking about a single link for 30 minutes. They were concerned about why a spam site had linked to them, and they wanted to make sure we didn't make that link. We hadn't. A spammer did. This happens all the time.
This company knew to beware of blackhat SEO, but they didn't really know what it looked like. Automated spam sites regularly generate links to legitimate content, and there's nothing you can do about it. Moreover, having a link from a spam site doesn't hurt your rankings. If it did, guess what everyone would be doing to competitors.
JCPenney, on the other hand, used shadow domains and link farming to make their site seem more important than it was. They built lots of links on unrelated domains and sites with unrelated content until Google's search results were compromised. These techniques aren't new. Blackhats have been using them for years to game the search results.
In the revolutionized world of the Web, spam is a constant.
When The New York Times broke the story, it seemed like JCPenney had gotten away with it. In fact, they went so far as to infer that maybe there was a conspiracy between Google and JCPenney. JCPenney enjoyed the top spot for hundreds of high-value keywords for months, and likely enjoyed a decent ROI over that time.
But as anyone in the search marketing world knows, when Google catches on, the party is over. Google just blew JCPenney's rankings out of the water. Their traffic has likely flatlined now.
People engage in blackhat because it works. It really does.
Some blackhats will work for months to rank a valuable term for just a few days; they can get a quick payoff before being banned. Blackhat can be seductive, and when you're riding the high of all the juicy traffic you could wish for, it's hard to say "OK, we need to slow down and revaluate our strategy." Maybe this particular agency thought they could use blackhat tactics to get quick results before transitioning into a more metered, long-term SEO strategy before Google caught on. In the end, it doesn't matter: JCPenney fired them. It turns out trying to trick search engines is a bad PR move.
JCPenney isn't the first (and certainly won't be the last) to go through the boom and bust of the blackhat roller coaster. Usually, no one hears about the sites that get banned because they're smaller or less known. JCPenney has a century-old brand and had more to lose from blackhat than it had to gain. These kinds of tactics are not nearly as rare as most people think. Cheating pays, at least in the short term.
In fact, it's so common that we check all of our new clients for signs of black magic and regularly find hidden text, keyword stuffing, link farming and all manner of other tactics in place. The number of Webmasters and marketers who think it's a good idea to be unscrupulous with their strategies is staggering.
Many of these companies have such short life cycles with their clients that it doesn't matter if a client gets banned down the road. They're only interested in getting results now -- consequences be damned. Dealing with clients that have previously used blackhat can sometimes be tough. When the bump they've enjoyed from cheating runs out, guess who's left holding the bag?
It's a lot like taking your car to a mechanic. If you aren't somewhat educated on what they're actually doing, they'll take you for a ride.