That would mean a user who manually blacklisted 10 domains took on the added risk of letting 10 ads through that were potential malware vectors. Another proble

That would mean a user who manually blacklisted 10 domains took on the added risk of letting 10 ads through that were potential malware vectors. Another problem is that the ads the user deemed to be acceptable visually don't necessarily carry a correspondingly lower risk of malware. Yet another problem is that the user likely thinks that by allowing ads for domain X they are allowing X to serve them ads. When in reality, they are allowing X to add a third-party service Y that sells access to Z, and that neither X nor Y currently have a way to guarantee that bad things won't happen from letting Z (or even who Z is, or that Z was a possible participant when X signed up for the service).