Actually, Google do take a suprisingly huge amount of money in advertising revenue. For instance, they rake in more advertising money than any newspaper chain, magazine publisher or TV network. Think about that. Their main brainwave was to auction "keywords" to the highest bidder in online auctions. Instigating bidding wars for lucrative and sought-after keywords is a real easy way of driving up prices. What Google do is sell a per-click price for a keyword or phrase - popular items have been known to go for up to $10 a click. Yes, that $10 to Google every time someone clicks through via an advert on Google or their affiliates. And because Google are not selling any physical (and don't have any associated manufacturing and shipping costs) this is nearly all profit.
It's more complicated than that. Although the auction may be seen to drive up prices, advertisers set prices based on ROI and ROI is sensitive to publisher fraud as well as conversion rates.
Let's say as an advertiser, I am selling widgets, and I want to acquire 1,000 customers. What is the cost to acquire a customer? Well, I may go on Google and buy CPC ads for $1 per click. I may find that it takes on average, 1000 clicks to net one customer, in which case, the customer acquisition cost is $1000, so I better be selling cars or real estate.
If I were selling something cheaper, like software, I may find that the cost is too high. So therefore, I may adjust the rate I am willing to pay to 1 cent per click, in which case the customer acquisition cost is approximately $10. This is all sensitive to fraud, so if publishers with AdSense setup click farms of click robots, I might see that 1,000,000 clicks are needed to generate 1 customer, in which case, if I still wish to pay $10 per customer, I must set the price to be $.000001 per click. You can see that fraud doesn't actually hurt advertisers as much as publishers, so that someone running a clickfarm drives down the price per click and diverts ad revenue away from your legitimate site with legitimate users and content (but low number of clicks) to someone running an illegitimate site with millions of irrelevent clicks.
Thus the market price of a CPC keyword is sensitive to both fraud as well as the underlying customer conversion rate and is not purely a function of people bidding.
It is also incorrect to say that Google does not incur costs for running the ad network. First, for many clicks, they must pay publishers on the ad network unless the click occurs as the result of a keyword search on Google.com. Secondly, Google has an army of people working on their ad network which is a huge fixed cost to the company. They did not develop the network and then fire them, but they continue to employ them in the extension and maintainence of the network. When Google launched Google Checkout, about 1/3 of the company's engineers involved. With a cost per engineer over six figures, this is not an insignificant cost to them.
The reality is that although advertisers bid on keywords, most intelligent advertisers use campaign management software to optimize the ROI on ads, both to combat fraud, as well as minimize customer acquisition cost. Many ad networks also sell cost-per-conversion/sale based adds by tracking hits on your "checkout succeeded" pages. The raison d'etre of Google Checkout is to do this on a large scale as well as control ROI.