Earlier quoted context omitted.
It empirically is allowed, though. Google is welcome to claim that it's against their rules, but they still let it through.
Do you know how many they ban on a day to day basis? You don't see those, you only the few that get through.
Ban? They shouldn't need to look for bad actors or ban anyone†, they just shouldn't let people spoof the domain on an advert. At all.
What's happening is Google would rather accept the cash up front and keep it if and when someone reports an ad. No forethought is given to people tricked by this.
† Obvious exception for unicode squatters but even they should be filtered out entirely automatically. Invisible or misleading characters in your domain should be automatically blocked.