They don't need to do the click fraud themselves they only need to not catch all of it. That's much less work.