The story’s not about blocking every possible malicious ad, it’s about making a report and still letting the ad through.

The ad probably looks at the IP address, sees its from Google and show a legitimate ad.

Google can easily solve this with using external IP addresses, but doesn’t. Because money.

There’s nothing to appreciate here.