Honestly it works a lot less well than it used to. Google's been actively going after site reputation abuse and thin listicle stuff since 2024, and a fresh domain still needs a year-ish of real content before it ranks for anything competitive. So you'd be funding a whole second site that one update can wipe, and if it ever gets traced back to you it's a genuinely bad look for the main brand. Fine for a legit resource site you'd build anyway, terrible as a shortcut.
On taking them down: the Google spam report form exists but don't hold your breath, it mostly feeds their classifiers rather than triggering manual action on a specific site. Undisclosed ownership of a "review" site is an FTC problem in the US though, and if they're using your trademark anywhere you've got real leverage there.
Boring answer but outranking them is usually cheaper than fighting them.
