My project has been having fake ads bought on Google to serve malware for a year now and Google doesn't seem to care. At best they might take down one ad, but there are always more.
[1] Back when I worked in the business this was only possible in the US, for legal reasons I didn't fully understand.