Yes, sadly there are. It's not necessarily out of malice, a lot of folks just don't grasp how big spider traffic is. Even Google Analytics doesn't filter out cr

Yes, sadly there are. It's not necessarily out of malice, a lot of folks just don't grasp how big spider traffic is. Even Google Analytics doesn't filter out crawlers by default, that setting is buried somewhere in the admin panel. You're right, "time spent on ad unit" is simplistic but it's not inefficient. It shouldn't be the only thing in your arsenal but it's a good signal. I reckon you are also overestimating the amount of sophistication that goes into these systems. The ones that are out for purchase in a black market become well-understood within a few weeks and are easy to fingerprint. Since the network is paying on net-30 days, there is some time to retroactively run some analysis and filter out provably non-human traffic.