My question is if one competitor wanted to kill my ads, couldn’t they just click it maximum amount of times and I would pay for nothing?
No – this is called “click fraud” and Google has many protections against this. Your competitor can click on the ad multiple times, but you will get refunded for unusual / repetitive clicks. If it persists, then Google will block that IP address from seeing your ads.
This is actually very uncommon and only happens occasionally. In one instance a few years ago, we also blocked the zip code of a competitor that was attempting to do this.
How is this monitored?
Click fraud is monitored by IP address, cookies and Google log-in ID. There are other behaviors that they model for that indicate click fraud. It is fairly common to see one or two clicks being refunded every month – not necessarily for click fraud, but because someone clicked on the ad twice in the same day. The clicks still went to the website, Google just realized after the fact that it was the same person and refunds the second click.