Because most of the ads are created by external ad agencies, and the people involved are not competent enough to do any verification.

Source: I've also thought this was ridiculous and asked someone working on the adsense team. Apparently tried enforcing some domain verification mechanism in an experiment, but most companies and agencies struggled to get the verification done and of course the $ metrics on this launch dropped, causing execs to force them to stop.

Maybe a partial solution here would be to offer some kind of "domain locking" option?

Allow sites that are heavy targets of this kind of scam - like ticketmaster - to add a "AdSense: locked" line to their robots.txt (or similar) - if that line is present then advertisers have to go through an additional domain verification step in order to place an ad.

I like this idea. I would love to hear from Google why they would not do this. Anyone know why Google / Facebook et al would not want to do this?

Money

Money. And no one died because of this behaviour. So why change a running cash-machine...

Not necessarily, if you have an affiliate program or something like that you could buy ads for, say, eBay using your affiliate link in the hopes of you generating more profit than the ads cost.

There are also still plenty of businesses with a Facebook page as their homepage

There was a time when you search for WhatsApp in Google the first sponsored result is a scam site

If you search for "HP Support" or "Dell Phone Number" you will get a scam site 50% of the time now.

One time an article about Facebook logins got to #1 and its comments were full of people mad that Facebook changed their website yet again, how can they login to Facebook, waah, waah!