They leak data that enables the marketplace they run and profit from. That's the indirection. They count on this obfuscation (lack of an explicit transaction for the bid request data) to keep people from thinking of them as selling data.

Collectively the participants use this data to optimize their future bids and other surveillance/marketing efforts outside the Google ecosystem.

I'm sure Google would prefer there not be any parties involved that are purely leeches. But they may not be able to or may not care enough to tell the difference between leeches and parties that are still working out their infrastructure and bidding strategy and will begin bidding eventually. Or perhaps making a certain number of low bids you don't intend to win is what keeps you in the game.

Google doesn't want the leeches, they throttle the buyers who don't win enough, and Google was forced by the law to make lot of privacy improvements.

For example, before the GDPR you would receive the full IP address of the user and the visited webpage URL.

123.456.123.456 https://www.youtube.com/watch?v=vNvlZg_zh1s

Now you receive only:

123.456.123.0 and more limited information about the context

Though this better privacy has a cost, because it means less revenue for Google, but also less revenue for the publishers, and less relevant advertising.

So this is something like Greenland Island, as long as Trump don’t pay, it’s not sold to Trump?