It does not matter whether or not they are paid
In 2017, Google employee John Mueller said that all the links in guest posts need to close the attribute nofollow. This week, he also added that even if these links are not paid, they still must use the nofollow attribute or a new attribute sponsored .
"... If you provide content / links, these links do not need to transmit signals and should have the attribute rel = sponsored or rel = nofollow», - said Mueller.
Earlier this month the company SEMRush accused in selling links through a new service of guest blogging. As a result, the company decided to suspend testing of the service.