I ask this question because there are institutions that pay authors an honorarium to add the institution as an additional affiliation when the authors publish, even when those authors do not have any kind of contract or appointment with the institution, nor do research or teach there. This is clearly a way to game the system and increase the number of publications accounted to that institution. This is evidently not ethical, but I do not know if there are any stated policies or regulations on this practice. The end result is that a university that does do not provide funding or resources for research will have the same number of publications as the university that does conduct and foster research.
As far as experience goes, an author's institutional affiliation matches the location of their name on a payroll, regardless of their publishing.
In other words:
- on the payroll of University of 123 = institutional affiliation is 'University of 123'
- on the payroll of no research institution = 'independent scholar'
Any other arrangement may be characterized as 'creative affiliation'(along the lines of creative accounting).
This is pretty old, but I will provide an answer to an increasingly relevant question. Affiliation is understood to be where the major part of the work was done. If this is not the author's current primary employment, then those details should be included in the contact details and/or acknowledgements. Any paid affiliation is unethical. Surprisingly, I did not find any reference to this "creative affiliation" in the COPE standards https://publicationethics.org/.
Many publishers include a statement about what to do if affiliation changes during the publication process - i.e. how to credit the institution where the work was begun and the institution where the publication was finalized. For example "Present/permanent address. If an author has moved since the work described in the article was done, or was visiting at the time, a 'Present address' (or 'Permanent address') may be indicated as a footnote to that author's name. The address at which the author actually did the work must be retained as the main, affiliation address." from Elsevier Guidelines for Authors (https://www.elsevier.com/journals/journal-of-archaeological-science/0305-4403/guide-for-authors, but they all include this). It seems that what the OP describes is so unethical that no one has addressed it explicitly (yet).