A Google penalty is a punishment given to a website that has acted against the search engine’s webmaster guidelines.
It’s not against webmaster guidelines to have 404 errors in a website. Therefore there is no penalty related to 404 errors, and Google has confirmed this many times.
The HTTP 404 status code is just a tool, and because of that, is absolutely fine for webmasters to use. For instance, a 404 page is the correct status code to present the user if they are looking for a non-existent resource.
Best practice dictates that a website should not have internal links pointing towards non-existent resources, as this leads to a poor user experience. At the same time, a webmaster ought to be aware if any resources are returning a 404 status code by mistake.
In Google Search Console, webmasters can find a list of 404 errors (not found). It is good practice to periodically go through the list and examine each error, to understand if it is correct that that specific resource is non-existent. If not, then that resource should present a 200 status code.
Another good practice is to crawl the website periodically with a tool like Screaming Frog SEO Spider to look for any 404s missed by Google.
This post is the English translation of a chapter of the italian ebook “Mitologia SEO” written by Enrico Altavilla.