I wouldn't consider my website to be a well-ranked website on Google, but yet here I am with this Bing issue. I believe you're right: Bing allows spam-links to taint the reputation of a URL until they decide that the URL — the victim that has nothing to do with the spam-links — should go. Incredibly unfair and nonsensical for a search engine.
Of 3 sites hit I submitted a support request for one and did nothing for the other two.
My support request was responded to after about 3 weeks with a bland generic message saying the issue had been resolved and I should see my site listed on bing again shortly.
After a few days the homepage was listed, a couple of regular pages and then multiple instances of results that should never be crawled, let alone indexed (Obscure file query strings and such). I'm guessing this was a result of a negative seo attempt?
Anyways, I had to do a bit of work to get those results removed and things went back to normal after a week or so.
The other two sites came back on their own. I didn't notice any weird indexing issues with either of these but, because I had almost given up hope of them ever returning, I was not checking that often. It could be that any such issues cleared themselves up over time?
Anyway, long story short, it looks like this is something that sorts itself up eventually without the need for any intervention.
All 3 of my sites get attacked on a regular basis with multiple bad links schemes, plagiarism, etc and google manages, for the most part, to ignore all of it. Not sure why bing can't simply do the same?
Through Bing Webmaster Tools, I can see pages being crawled, but not indexed. Bing has the sitemap and all the URLs. The robots.txt allows all crawlers. Even if there was an issue there, it would be on their end, and they should be the one fixing it. The result is the same: a mysterious disappearance from their SERPs. And no way or clue on how to fix it.
No doubt they'll attempt to crawl and their webmaster console will say so, I just think it's important to verify the request actually made it to your server via your own server logs in cases where you're using a WAF like Cloudflare, just to ensure that Bing saw what you intended to serve them. If they're reporting 4xx errors, it could just as easily be a WAF giving them the code, or your server but judging by your response, it wouldn't be your server. The server logs would explain away some of the issue.