Bad actors are paying for Google ads to install bogus version of Oh My Zsh

Not just "Oh My Zsh" but pretty much any piece of software. Try searching for "vlc" or "filezilla" or something and I can pretty much guarantee that the "sponsored" links are viruses/malware. I remember once having to show my boss that the "filezilla" link he was going to click on from Google was fake/malicious.