Malicious actors are almost certainly incredible revenue drivers for Google, and people on the ads team are protecting them because they make their metrics look good.
This is one of the downsides of a Google monopoly (/single advertiser market): they don't have to care about click fraud besides making sure it doesn't show up in headlines. Even if Google suddenly had a reputation for click fraud, not advertising on YouTube and the rest of the web can be a death sentence to staying competitive in your respective market.
The facebook targeting back 2 years ago at least, amazing. There is a niche for hyperspecific advertising and facebook just crushed it (I'm not posting on facebook / no facebook app, so I think they suck for human health).
What a lot of HNers don't understand is that:
1) if you're a digital marketer with a budget, you have to spend the budget. Even if you know the metrics don't add up, you just keep spending until somebody finds a platform with a better ROI.
2) ad platforms don't like to talk about their secret sauce, because that would attract scrutiny.
And anyway GDPR/CCPA type legislation is probably a better route, which if anything makes fraud detection even more difficult.