Search ads have been the canonical leading way my clients have ever seen malware. I find Google search ads less regulated and less filtered than spam emails.
I'm really glad they're finally doing this, but it still feels way too irresponsibly late considering the amount of damage they've caused.
And Google is still one of the least affected markets. If you look at other ad marketplaces, they often tend to have larger amounts of malware spread through their system. Mostly because Google at least has somewhat decent detection algorithms and a large enough team that can take down large scale malware 24x7.
This is a massive problem in my experience; even if I report the ads spreading malware to Google they don't ever take them down.