So if I am running Facebook Ads and I get a load of fraudulent traffic, who is instructing these bots to make the fake clicks and why? Facebook? They have the motivation. They are getting paid per click. But I don't think they would dare. They would get sued into oblivion if they got caught. A competitor? They could be trying to burn up my marketing budget. But it seems it would require a bit more technical sophistic…
I think the history of corporate bad behavior has demonstrated that any time you say "Surely, company X wouldn't dare to do [some profit-making thing]" you're probably wrong. This applies to all companies, not just Facebook. Revenue = R, Cost of the activity = A, Probability of being caught = P, Likely fine = F. If R > A + P x F, you do the thing.