Depends on whether it's the site itself that gets hacked, or the ad network. (The latter is going to be a much more valuable target in practice since it allows malware to spread via multiple sites, not just one.)

That depends on whether they hack the site to actually feed the malicious content or just get enough of a foot in to get it linked from an actual hosting location. If what they have is a database hack where they can inject some content but don't have full control, they may be pushing links while trying to get further access.