What I mean is actually this: Google, Facebook, etc. are opaque about fraud, to the point of misreporting metrics in Facebook's case. Let's say hypothetically that the advertiser had an oracle for whether any individual ad view was fake. I'm pretty sure the advertiser would be paying less. That difference is what I meant by bearing much of the cost.

Google/Facebook's marginal cost for the fraudulent traffic is basically just the cost of infrastructure. The publisher (if there is one) is often the one causing the fraud, so they're not really "bearing the cost."

If only one bidder could tell the difference, that bidder might just buy fewer ads because ROI estimates will be lower, so fewer ad buys would look like positive ROI. Of course, that's under the assumption that fraud inflates performance metrics, but I think that's a pretty safe assumption.