I know that it's a question about MVC, but I think the example I'm giving (Web API) will be usefull.
I'm developing my first Web API and I'm re-using the business logic from other applications. To be specific, it comes from an external DLL, so my API is used just to "talk" with a SAP solution, receiving requests from PO and send responses back.
How could I put my logic (already implemented) into my controller? I don't need it. My controller will only receive, validate requests and compose responses to send data back.
I'm working with ViewModel classes and all they must have is a mapping function, just to read information from TransferObjects (that comes from the external DLL) and translate to a ViewModel.
I'm not comfortable with my application (in this case Web API) holding the business logic, I think that the re-usability will be lost in this way.
I'm treating my business logic as a dependency that I inject into controller.
I've done a lot of refactoring in the legacy to provide a Unit Testable solution, I had to create a lot of interfaces and implement some design patterns into the legacy to provide this solution.
In my point of view, the business layer must be apart of the application, preferably in another class library. So you will have a real separation concept implemented in your application.
Of course, if your CORE (business) is your application (API/WebSite), the business rules will be implemented into your MVC classes. But in the future if you want to develop a new app and some business rules are the same, I bet you will have a lot of problems just to maintain the same logic implemented in both applications.