It's the vistors that decide which ads they open and which products they purchase.
Not those that sell advertisement space.
I guess I have higher standards: I don't advertise anything I don't trust.
Legally, you're probably right though. Google has been earning money having phishing sites advertise on their search results for many years, and reporting the ads doesn't mean they get removed so it's intentional.