Like the Tacoma, 4th-gen 4Runners in salt-belt states can have frame corrosion. The 2003-2009 generation was NOT covered by Toyota's buyback program — owners are on their own.
Inspect the rear frame rails, leaf hangers (if equipped), and cross-members. Scale and surface rust = normal. Flaking, perforation, or "swiss cheese" pattern = walk away. Use a small hammer or screwdriver to test.
Est. cost: $0 to walk / $4,000+ frame work / write-off
Source: NHTSA frame complaints