They're not trying. I've seen an advertiser remain active for months with literally tens of thousands of ads where clicking them directly downloads a malicious exe file that most antivirus scanners flag.
Some places suggest "try logging into Google with your phone number, and deleting the account that's associated, if you don't need", that just ... doesn't work.
Phone providers should also be detecting this with AI. There is no way this should be occurring anymore.
Edit: I’m not implying this is morally right or good for anyone but Google shareholders. This is just 21st Century American capitalism