The merchant pays for each click on the ad that is redirected to his product page. What seems like a recipe for wasting incredible amounts of money on an army of click bots is working - because the merchant defines a target cost of sale for those clicks, meaning for example he expects a sale worth 100$ when spending 10$ on ads (a cost of sale of 10%).
And the merchant will set a budget and won't repeat/continue a campaign beyond those costs, so it is in the ad publisher's best interest to deliver real paying customers instead of an army of bots.
Cost of sale is of course different for each product category - clothes and perfume have huge margins (so the merchant may be willing to pay 30% of the final sale price for advertising costs), computer parts less so.
In the case of ebay and amazon and other large retailers it's common to not pay per click but for a percentage of an order's total volume (x% of shopping basket's value once an order is placed). In that case, we have to trust the retailer to deliver correct sales data to us.