Typically an ad will go through multiple vendors (dsp, exchange, ssp, ssp, etc) and then to the publisher. One of these will catch it, and if not a publisher as big as NYT has tools in place to catch it.

But yes things can slip through, but its mostly unapproved creative (gambling, etc) rather than code which is easy to catch.