So Google does not serve the ads from its own servers? Google just runs the programmatic auction and then lets the winning advertiser point to whatever slow, non-HTTPS ad server they like? I guess once Google gets paid by the auction winner, they don't care what happens next with the served ad. And serving it from their own servers would just be an extra cost.

No, they don't actually serve all ads. I imagine they know not to pass off a request from a HTTPS page to a HTTP-only server (mixed-content blocking would give a near-100% failure rate) but here is an example of Google's Doubleclick network being used to spread malware: https://blog.malwarebytes.org/threat-analysis/2014/09/google...

I think it can do both. Kind of like how Amazon sells products that ship both from its own warehouses, but also from the vendors directly. But just like with Amazon, there's probably an increasing amount of ads that come directly from the vendors.

This is what surprised me, I assumed Google ran all ads through their own servers.