I'm not sure what you expect "Google ads serving malware" to mean other than exactly this. Of course it's not as simple as going into Google ad manager and clicking "upload virus". The fact that it included partner networks and a compromised website is unsurprising. When malware makes it through ad networks, it is common for it to take that kind of approach. At the end of the day you're effectively exploiting networks of trust.