How do you figure out what is a malicious ad? That seems really difficult at scale.

If you're asking socially, you don't, that's the benefit of writing laws instead of programs.

If you're asking technically, well, google made over 400 billion dollars last year, they can spend some of that to figure it out.

Or stop serving ads. Just because it's difficult to do safely doesn't mean you get to just do it anyways because there's profit involved.

You start with the obvious cases of sending you to a domain that serves malware, sure there will be instance of fraud that will slip trough, but lets not let best be the enemy of good

"At scale" sounds like an assumption that costs must decrease as income increases.

That's not required. Google could employ proportionality as many people reviewing what they advertise as, say, National Geographic Magazine.