Not sure how all that can be separated out meaningfully as it is the platform being used and advertisers have expectations based on whatever agreement has been struck between them. Maybe I misunderstood. Perhaps the difference in your example is a user acting versus a bot? Intent probably comes up somewhere as well, but I am not a lawologist. 🤷♂️
I had someone hijack my account last year, Like a dummy, I had failed to setup 2FA. I caught it in the morning after they worked it most of the wee hours. Phone and email had been changed. I contacted PP and to my surprise they were effective in righting everything. By the end of the day, it was corrected. I was absolutely shocked they were so helpful, but I guess it can happen. So, maybe try again?