I worked at a company that caught a major Chinese Internet company (not ByteDance/TikTok, but one even larger) red-handed engaging in deliberate app install ad fraud (their app would send forged Android INSTALL_REFERRER intents), so it would not surprise me.