Not just "Oh My Zsh" but pretty much any piece of software. Try searching for "vlc" or "filezilla" or something and I can pretty much guarantee that the "sponsored" links are viruses/malware. I remember once having to show my boss that the "filezilla" link he was going to click on from Google was fake/malicious.

Kind of amazed by the URL shown in the ad:

  https://ohmyz.sh›app/download>lauralen.com

lauralen.com appears to be entirely AI-generated. But the presentation in the ad sure looks like the legitimate https://ohmyz.sh/ - I knew it was a scam yet I still got confused.

I've never purchased an ad - does Google let you enter custom display text for your URL? Or is there some more sophisticated trickery here? (e.g weird unicode in a header or something) Either way, what a mess.