I'd bet nearly every parking company does use zero click.
First thing necessary is to understand the reason for zero click which is a form of 2nd-tier advertising. 1st-tier is Google. The problem with Google is that they will ban certain domains from PPC with zero explanation. Extremely generic domains. I'm talking domains like Airfares.ca. Explain to my why google would ban that??? But I've even had Bodis raise a case with Google to un-ban it, only to have them turn around and say no. Google is Judge/Jury/Executioner with ZERO explanation. They just don't care.
So - when domains are banned from 1st-tier, they still have the option to be monetized with 2nd-tier, basically just ad networks not as big as google. Some are still just landing pages with typical PPC advertising, others are zero-click advertisers. Zero-click makes sense as on a domain like Airfares.ca, that page view is guaranteed to be sold to the highest bidder.
So the practice of zero click is 100% legit.
HOWEVER - that being said, I've dealt with the scammers for years, as I had started my own PPC company called TrafficClub 15+ years ago. Scamming is lucrative and stopping it is never ending task. And they will go to incredible lengths to hide their tracks and get away with it. In the case of zero click, the scammers present themselves as legit ad buyers, sometimes going through a multiple layers of PPC companies. After a while, they start slipping in the scamming URLs. And this can happen with both PPC and Zero Click. There are billions of hits a day going to PPC and even a tiny percentage of scamming is horrible - but nearly impossible to detect.
This practice has been a scourge for more than a decade. I am part owner of a domain that used to make 5 figures per month, and the ads slowly got scammier and scammier, back then it had to do with cell phone based subscriptions to services that auto-renewed and it got to the point that as owners we had to turn it off because we didn't feel comfortable with it any more. Many people would just be like, eff-it, I'm making too much money to willingly turn this off, even if it is evil.
Also note that I've had this exact argument with Bodis. I've found the same thing, domains with zero-click to install hacked software just like you're pointing out here. I gave examples to Bodis and they promised me that they banned that advertiser, but that they said its unfortunately a game of whack-a-mole, and it takes up a large amount of resources. Despite that, they claim to always be looking out for it, and you can and absolutely should, raise hell to Bodis or whoever it is. But it's a catch-22, you're not supposed to be visiting your own domains for fear of being accused of fraud, but you need to monitor for the scammers like this too. Unfortunately I have found that Bodis has plenty of technical issues and a couple times a year, I have to raise hell with them over something. Right now its due to an issue with some "features" that aren't working correctly, which I discovered on the weekend...
In any case, its not the zero-click process that is the problem - its the scammers. Scammers will always find a way.