If Google takes money to host an ad that’s malware, they should be able to be prosecuted for it.

This is different than simply hosting community content that they can’t reasonably moderate. They’re being given money to distribute these ads, so they can afford to moderate them.

Which should be easy anyway. Ads shouldn’t be able to install third-party shit from the advertisers on user computers. Google can easily restrict what can be included on an ad package.