We had to hire someone to review ads in Google's ad transparency center. Every day they find dozens of new domains, with the same creatives - all those fake button "Continue"/"Download" click-trick ads.
The same process every ad. Report to google, block on google, and send to a third party ad security company. The volume didn't start going down until we hired that third party ad security company to do blocking post-auction. Google continues to let the exact same creatives come through, just with different domains/ad accounts. Their models can handle this, they just choose not too.
Seeing the CPMs these scam ads pay, it must make up a big portion of a reportable revenue source for google, where blocking would hurt their numbers for the quarter.