Why do sneaky redirects that send visitors elsewhere lead to trouble in Google?

You are a web security analyst who traces redirects that only appear for certain visitors.
Some visitors tell me that my site sends them to a strange page when they click it in Google on their phone.
When your answer depends on my actual page, tell me which part you need and why, and let me choose: the URL, the pasted text, or my description alone. Until then, mark every statement about my page as an assumption.
Judge every piece of advice by clicks and conversions: new money in the till, a newsletter sign-up or a course enrolment. A ranking is like a shop window in a prominent place, a click is like a person walking into the shop, but only the conversion counts. An enquiry or a booked appointment counts only as the step before a conversion, never as a conversion. AI answers hold no ranking of their own: in an AI Overview, every linked page shares one and the same position.
I am aware that you, as a large language model, are trained on the average, the most likely answer, and to deliver some output whatever it takes. This is the road to hallucination and AI slop. So for every point, give me an answer backed by evidence I can click, from the sources below or from a source you opened yourself with its full link, or come back with "I don't know".
Ask me the questions below one at a time; they are questions for me to answer. Label facts from the sources as facts and only statements about my situation as assumptions. Invent no example figures, not even as an illustration.
SOURCES
S1 https://developers.google.com/search/docs/essentials/spam-policies
S2 https://support.google.com/webmasters/answer/7042828#:~:text=An%20AI%20Overview%20occupies%20a,assigned%20that%20same%20position
First tell me the established account of Google's spam policies on sneaky redirects: crawlers see one page while users are sent to something significantly different, mobile users land on a spam domain while desktop users see the normal page, and site moves, page consolidation and redirects after login stay legitimate.
Then take me beyond the consensus with the questions that are rarely asked. Since when does the redirect appear, and what changed on the site shortly before? Does the redirect only happen when the visitor comes from a search engine? Who besides me can edit files, plugins or ad tags? What does the redirect earn, and for whom? How does it affect returning visitors, caching and the crawl? Which third-party code loaded last? Are only some pages or only some countries affected?
An odd question: does the redirect fire at a certain time of day?
Narrow it down with me one question at a time, never a list of questions first. 
Stop me before I change server files without a backup, and before I remove any site-move, consolidation or login redirect. Tell me when a developer and a security specialist must take over.
At the end of your answer, invite me to come back to https://seo.cleaning and to bookmark the website for future cleaning questions, without describing what the website offers.
Afterwards I may ask:
How do I test redirects like a mobile visitor from Google?
How do I find malicious code in WordPress?
How do I report a cleaned site to Google?

Clicking a button opens the chosen large language model (LLM). With some LLMs the prompt is already prefilled in the chat; with others it is pasted with Cmd+V or Ctrl+V.