But they don’t. Google and others do vet ads, but when they don’t host them, the ads can change based on who is looking (clean ads for Google! Not for you!).

Google didn’t have this issue until they bought DoubleClick (text ads and they hosted). And they had pretty good privacy as they didn’t want to share shit.

After DC it all went to hell.

Define "validate". App Review is really only good at catching things that make Apple uncomfortable for financial reasons, or make their attorneys worried (trademarks, copyright, etc.) The sandboxing is what makes the App Store pretty unsuitable for distributing actual malware (the kind that can do stuff to your device without you knowing).

Well if they cannot technically differentiate malicious, then they should drop that business niche. They receive money for that, similar as selling stolen goods.

Cause that would cut into their profit margins, and section 230 absolves them of liability

Newspapers and magazines didn't sell ad space to obvious crooks back in the day. Scammers didn't have tv ads. Obviously there was somebody watching them. The trashy scams were reserved for the real scummy publishers: comic books.