The difference is that app stores are pull-only. I have a subset of apps I allow on my phone, and random ones aren't downloaded every time I open it up. With websites, you don't get to pre-approve the ads that get downloaded, and since these adds are auctioned dynamically, you can't even say that one website is safe or unsafe.
If you want to make an analogy with app stores, visiting a website that's hooked up to an ad network is more like opening the Google Play store, entering a random search, and then clicking install on whatever the first result is. Yes, the web has better sandboxing than Android, but that's still a wild thing for any user to consent to.
When I installed the Play Store on my phone, I wasn't agreeing to give every single app it hosts access to my device. But that's what ad networks essentially force me to do.