The problem is enforcement. Telling malware distributors "that's not allowed" obviously isn't going to do anything, and it's easy to have the ad go to one place

The problem is enforcement. Telling malware distributors "that's not allowed" obviously isn't going to do anything, and it's easy to have the ad go to one place when Google is investigating and another when a user clicks the ad in the wild.