It's just a setting in Google AdWords. The display URL and target URL are not related. You can also play tricks like a "tracking URL template" that is a URL that can be on another domain and receives the "target URL" as a parameter. It is expected to redirect to the correct URL, of course nothing enforces this other than a manual review.
I can't believe that Google allows this but tracking is clearly more important to them than user security.