Not only that, the criminals can show different content depending on the originating IP range, presenting harmless stuff to people not directly targeted.
Even better, they can bid based on the IP address range and only pay for the suckers they target. Why go to the trouble of making a harmless ad when you'll never need to show it?