I'm not sure about that. It seems that the flaw used (described in other comments here) just required to do a GET request on the video stream, not stream it fully. So whether or not fake impressions took place depends on how and when ad impressions are counted. I would think you need to download at least part of the ad for it to count as an impression.

I doubt that Google can be (successfully) sued because some other entity violated the ToS. You'd probably have to show that Google acted maliciously.