The sites don't always know the ad servers have been compromised. A person visits a site, allows ads/3rd-party cookies, is surfing with admin rights, the ad servers gladly push their drive-by malware and ta-da... infected user. It's that simple...

Blocking ads, disallowing cookies (whitelisting), blocking the general ad industry is the only safe way. It's like sex: use protection.