I don't know if this is a snarky, rhetorical question, but there are many legitimate SEO companies out there. SEOMoz is a good example. A general rule is, if they guarantee certain rankings, avoid them, if they offer "directory submission" services, avoid them.
As soon as they start talking about "link building" my spam sense tingles. The same for "social media optimization".
So what is left? Glorified mod_rewrite hackery?
/edit: That's not a flame. I'm just interested what non shady SEOs do. The last time I looked into SEO it was all about rearranging your HTML so the spider would get to the content fast. And to put nofollows on your links to get the juice flowing the way you wanted.
But this wasn't that complex that it justified hiring an expensive SEO company. Sure, they all did that link building stuff too - but as noted above to me that's shady (it was mostly about spamming digg-like sites with top 10/5 articles).
I've started working with an SEO on a few things and I've seen a few things he does. mod_rewrite hackery is a part of it, as is validated HTML,/CSS meaningful titles, reducing load times as much as possible (basically doing well in all Yslow tests), accessibility stuff and other bits & pieces (like generating XML sitemaps, product feeds for Google product search etc etc).
A lot of this should be covered by any half decent site but as you may not find surprising, most sites out there don't know or don't bother.
Link building and social media optimization aren't necessarily spam activities (but I can see why you might correlate the two; there are a lot of shady link building operators out there and a lot of social media charlatans, for lack of a better word.)
While there are a lot of technical pieces to SEO (that go beyond mod_rewrite hackery, as you put it), most legitimate SEOs spend as much time on the marketing side of the equation. There are a few legitimate link building "tricks" out there, but most SEOs doing a good job at link building & social activities are focused on creating worthy content that ranks well in search and gets attention on social media sites.
BTW, nofollowing links to "sculpt" the way PageRank flows through your site doesn't work anymore - nofollow now "evaporates" the PageRank rather than forcing more of it through the other links on your page :)
Link building has all to do with making content that people find interesting enough to link to/talk about on social networks, and designing it to get links from certain types of sites with certain types of anchor text. As far as I know, Google is quite happy with that particular part of the SEO process, and it's firmly white hat.
