Absolutely, but those ads aren't usually pointing at outright malicious software, just shitty adware like download accelerators or whatever. Google's algorithms and manual approval processes have been pretty good at filtering out anything explicitly malicious, at least in my experience.
Even malware makes it into adsense , and if i remember correctly it took a few hours after reporting the ad for it to be removed. It's been a while since i ve had these reports though.
Could you give a real example for $popular_software which is showing a dodgey ad?
Searching for firefox on Google always returned a paid ad for a download of Firefox with 10 separate bundleware offers included.