All parties in the ecosystem tolerate some levels of fraud. The threshold for action varies over time (e.g., if ${bot-detector-company} has a press release that blames the Russians, people will care for a few weeks) and it depends on who is complaining. Detection of low-hanging fruit at small scales is often straightforward, and you can detect the clumsiest fraudsters using basic analytics tools. But detection at scale is hard, especially if you have a large number of clients that are not a homogeneous or predictable. The nature of organic traffic visiting streaming platforms, ticket sales sites, news sites, blogs, etc. are all very different. From my experience, the hardest part of the fraud detection space is getting some action in response to a fraud alert.

(Disclosure: I used to work in ad fraud detection)