I work in ad technology for a publisher. We put in a lot of effort to make the tech fast, lightweight and secure for our visitors - we hate bad ads too. We screen our partners, use whitelists and monitor what JS is running on the site.
This being said - things sometimes slip through the cracks. Somebody with a browser-based 0-day will pay huge CPMs to insert their ad and own thousands of machines. We can't prevent this - if you have any ideas on how, I'd love to hear it.