Conceptually, yes. Big vendors in this space have teams to detect malicious activity in their advertising network, but any team that claims to detect 100% is me

Conceptually, yes. Big vendors in this space have teams to detect malicious activity in their advertising network, but any team that claims to detect 100% is merely detecting 100% of what they know of. Browsers have gotten better and updates have gotten much faster, so less of that is drive by virus infections by exploiting the browser, but there's still cases of "Pick some users that you think are (a) real users and (b) naive enough" and serve them a exe download that contains a virus.