I get that it's a hard problem.

I don't think this is about "reviewing all search results". This is about reviewing the people who are paying you money to run ads.

In this case, there were likely plenty of signals of fraud. This advertiser was advertising to multiple domains, and each domain was relatively young. Those domains would likely also have had low organic traffic.

Here are some candidate solutions. I haven't thought these through deeply. This is spur-of-the-moment thinking. A multibillion dollar company could hopefully do better than me.

1 - Google could review new paid domains. In this case, the fraudulent site posted contact information, including the phone number for the real business! Phoning that number would have revealed the fraud immediately.

2 - Google could generally validate the identity of its advertisers. Advertising for a business? Cool, let's see some incorporation or tax paperwork.

3 - Google could impose a cost for being fraudulent. Want to run ads? Cool, we'll take a $1,000 retainer for each top-level domain you want to advertise. When you close your account, you can have it back after a 90-day waiting period. If we bounce you for fraud, we'll keep it.

I used to work in ad tech. We reviewed the people we entered into financial relationships with, because we knew their bad behaviour could affect us. Google could do similarly.