Bots can click through like any other visitors. They won't buy stuff, though, so if you're placing ads for people to directly take an expensive action ("performance advertising") you're mostly ok. Brand advertising, though, is very dependent on fraud detection because it doesn't have this clear connection.
Do you think it’s possible to measure how many people are coming from an ad on a specific site and buying something, without also resorting to illegal tracking?
That's a good point. I think a shopping site might be able to succeed in arguing that they had a legitimate interest in tracking how people arrived on their site, but possibly not. On the other hand, if half of your visitors consent to tracking that's enough to have a pretty good sense of the value you're getting from each source.
How do you know those clicks are people? (You can measure just conversions but that's a much higher bar for measuring an ad and a direct conversion may not even be your objective.)
There's more about this near the end of the post.