I suspect that if I had a site, piping assets from some arbitrary external company through my host would likely expose me to dramatically larger legal liability

I suspect that if I had a site, piping assets from some arbitrary external company through my host would likely expose me to dramatically larger legal liability than the current set up. It would also radically increase my bandwidth bills if the ads were anything but text or a small amount of (hopefully sanitised) HTML. Both of these could be mitigated by adding an enormous amount of due diligence in terms of what ads I was willing to serve, but that would add a lot of extra cost to running the site. There's no real technical barrier to doing it but I suspect the legal and operational barriers are more significant. And yes, the DOM is involved too - ad blockers block URL patterns but also allow users to block DOM elements based on a selector-type syntax. The hardest ads to remove are ones where the DOM selectors are dynamic - i.e. server-side rendering producing divs with random CSS classes.