The concerning part of this is that it can be ad-injected. Anything malicious directly hosted is a concern of course, but if a site is hosting something malicio

The concerning part of this is that it can be ad-injected. Anything malicious directly hosted is a concern of course, but if a site is hosting something malicious there are more attack vectors than just Javascript. Being able to attack via Ads mean a site that you should be able to trust cannot be trusted. The "informed" know this and block ads, but really this is just the 1001th nail in the coffin for allowing 3rd party ads for any reason. It's a security concern - not even a "I dislike seeing ads" concern.