Malicious advertisements are served off of normal ad distribution networks, which is what gives them their power - they're being hosted using the normal process

Malicious advertisements are served off of normal ad distribution networks, which is what gives them their power - they're being hosted using the normal process, not from anybody new or special. The server used for the malware is disposable and ephemeral. Vetting advertisements would interfere with the real-time auction process, so nobody does any more than is required.