The kicker is that scammers could claim their own site is being attacked in this manner and then drive up their clicks with bots. Google's response necessarily has to include denying sites revenue for clicks they deem fraudulent. This scam basically gives Google justification to pay sites whatever they feel like paying as long as at least some of their clicks look fishy.