Saying it's just the links may not be incredibly accurate but it wouldn't surprise me if they are the reason for their ranking. Many times, we give Google too much credit. Blog networks are still working quite well apparently. Although it's easy for us to spot a blog network, it's not as easy for a computer (Google).
However, there is good news. Their linking strategy is not a long term solution. Sooner or later, they're going to get hit and they won't recover. Or if they do recover, it will be after months of hard work and including a reinclusion request from Google and even then, they'll be back to square one. And guess who will be ranking ahead of them? People who built quality, long term links. And if those people continue to build those links, that other company can't catch up.
Contrary to popular belief, I have not seen the disavow links options work just based on filling out the request. You need to do some work in trying to get the links removed yourself and prove to them you did that work in order to have your disavow request go through. At least, that has been what I have read. I also have had a little experience with disavow, as my client worked with another SEO company before me that built these type of links. They are hurting us and our disavow request has been filled out for two months now. No positive movement as of yet.
To comment on one more thing, on-page SEO, while effective and a basic building block of your SEO strategy, has a very concrete ceiling. It can only do so much. That's why people focus so heavily on link building. There is no ceiling. You may have the best on-page SEO in your area but your competitor can easily replicate it. They can't as easily replicate your links, especially links built on relationships. In many cases, maybe on-page will be enough but eventually, as people catch on to the power of SEO, it won't be.
Get a head start now while you can.