According to Google’s official statements, hacked websites are demoted in search results:

“Recently we have started rolling out a series of algorithmic changes that aim to tackle hacked spam in our search results.[…] The algorithmic changes will eventually impact roughly 5% of queries, depending on the language. As we roll out the new algorithms, users might notice that for certain queries, only the most relevant results are shown, reducing the number of results show” source (Google)

Hackers will try to get backlinks from victims’ sites, or add irrelevant content on reputable websites (to rank for competitive terms, usually transactional keywords with commercial intent). A hacked site can also lead to a manual penalty – source (Google)