An iframe allows one party to securely embed something from another party. Ads are one example of this, but so are embedded videos, tweets, etc. In this case,

An iframe allows one party to securely embed something from another party. Ads are one example of this, but so are embedded videos, tweets, etc. In this case, having the ad in a cross-origin iframe is what keeps it from being able to read the content of the page, which is definitely something you'd want from a privacy/security perspective. (Disclosure: I work on ads at Google, speaking only for myself)