This has been happening to a smaller project I am affiliated with for years. You can report it to Google - typically they ignore the reports. Occasionally they'll remove the offending ad, but they are just replaced with more ads the following day. I don't think it's preventable.
A certain twitch category I frequent has had streams advertising phishing websites (phishing game credentials) on it 24/7 for a few years and twitch has never done anything about it. I guess if it doesn't cause public outrage then it's fine.
I tried using github pages with fastly, however it appears when a new site deployment is done, github does not invalidate the fastly cache, in addition to fastly independently caching resources on the site, which can cause broken site deployments for several minutes where it is using mixed cached resources from old and new deployments. I opened a ticket with github support, and they said it was expected behavior. It makes it partially unusable for me.
I have a small (2k+ stars) niche game-related project. The hardest part for me is saying "no". If someone proposes a change that I think is out of scope, or is not something I want to maintain (maybe the introduced complexity is greater than the benefit of the feature) I find it difficult to explain that in a way people understand. Often times people get offended by it and then become angry at me, and over time it becomes very draining.
My project has been having fake ads bought on Google to serve malware for a year now and Google doesn't seem to care. At best they might take down one ad, but there are always more.