If it went undetected for so long they must not have been at least somewhat conservative in their approach, so say 5mil DAU times 1 click a day at $0.25/click. So, million-ish dollars a day?
"Check Point estimated the firm was making millions from the ad clicks, in the region of $300,000 per month."
I imagine your price per click is over-estimated by a couple orders of magnitude, but that's just a guess.
[0] https://www.forbes.com/sites/thomasbrewster/2017/05/26/googl...
Google makes more than $25B/year in revenue so even with a 30/70 payout (30 percent to the fraudsters) maybe .001% of Google's ad revenue?
And that is why people do this stuff. Other than getting booted off the store nothing else will happen to these people who just made tens of millions of dollars.
Upon clicking the ads, the malware author receives payment from the website developer, which pays for the illegitimate clicks and traffic