Like many takedowns of the digital ad industry, this paints an incomplete picture.
We use 3rd party impression and click tracking, along with pairing purchases to user/session ids to make sure our ads our working. If a user tries to mask their data from us, they simply come in as direct traffic, and we don't attribute that to our ad campaign.
If this fraud stuff trips you up you aren't doing it right.