The websites (or at least Google & Facebook - not sure about Microsoft, it could just be low value ad space that nobody really wants?) you've described are known as "walled gardens" in advertising, meaning the DSP (demand side platform, where people who run ad campaigns manage those campaigns), SSP (supply-side platform, where websites & apps with available add space list that space) and at times the website itself are all part of the same company.

This creates a conflict of interest - essentially DSPs want to place as few ads as reasonable as they only want to advertise to people the ads will have an impact on. SSPs want to show as many ads as possible so they get paid more. This results in walled gardens, like Google & Facebook, showing ads more than they should be resulting in overcharging as a result compared to an optimally run campaign. Many reputable companies and ad agencies are aware of this and so advertise less with the walled gardens, resulting in proportionally higher scam ads, as no agency would run a campaign for them.

There's also the fact that they have no relationships to maintain. If a DSP is constantly showing scam ads in the ad spaces they buy, then they'll get blacklisted by the SSP. Same the other way around if the SSP keeps selling misrepresented ad spaces that will never be seen or will be resold every 5 seconds to the DSP, or otherwise not being a trustworthy partner to work with. As the walled gardens don't need to maintain this relationship and there's no risk of being blacklisted, they can effectively advertise whatever and put ads wherever on their website - they're generally powerful enough that people will use their product anyway, so there's no downside for them to accepting scam ads if they're paying.