If they're attempting to make money from ads, they're not offering it for free.
In any case, even in a commercial transaction, there is an element of reasonableness to what is expected. If I buy a $50,000 car and it breaks down on the second day of having it, that's obviously well below a reasonable standard. If I buy a $10 toaster and it breaks after a couple of years because the crumb tray didn't quite fit? Maybe that's more reasonable. If I buy a $10 toaster and it catches fire and burns my house down after a couple of years because of a design flaw that the manufacturer knew about but didn't fix? Again, not so reasonable.
In this case, we have a content provider who is making at best a tiny amount of ad revenue from a visitor, yet some people here seem to think there is an ethical obligation on that content provider to provide a literally impossible standard of monitoring of the behaviour of the ad networks anyway. As I've mentioned elsewhere, even the argument that they just shouldn't use an ad network in the first place doesn't really work, because logically you'd also have to apply the same ethics and accept responsibility in the same way for any other third party content, such as scripts hosted on CDNs. By the time you've finished knocking out any sort of third party hosting just in case a rare instance of malicious content slipped through the net, the web would be a much worse place.