It’s also a huge vector for actual phishing, especially because google ads doesn’t use puny code, so it’s easy to buy ads for sites that differ by just a diacritic
Granted, it's partly my fault for letting a loved one be that computer un-savvy, but that kind of ad should have been detected and blocked before it was ever served.