That's a key point. Google's primary business model relies on convincing you to
not click on the "best search result". This is why they have, over time, reduced the visible difference between ads and real results. I've regularly found that lay users are not aware they are clicking on ads when they click on Google's search ads.
Even if Google is removing "x million bad ads", they are merely replacing bad ads with other bad ads. Removing bad ads doesn't significantly impact their revenue. I'd argue that while Google is willing to make gestures like removing some ads, they are unwilling to do what's necessary to protect users: Stop serving ads entirely where malicious ads are particularly prevalent, and clearly highlight the difference between ads and search results.
EDIT: Here's some captures I did this morning of Google results on incognito: https://oasis.sandstorm.io/shared/nTZcQOHrTgnM-90dAfmut0AX_c...