When it comes to computer intrusion, you often do not need to prove damages. Many jurisdiction has made it a criminal offense, and other has based damages on the amount of time a professional would spend on repairing the damages.
Each personal computer and laptop should be in the range of a $200. A work desktop or server should be in the range of $2000-5000, since then you got to verify the integrity of data and secrecy of costumers. Since a maladvertisement attack hits tens of thousands of users, a class action suit could be in any range, and it would be hard to guess the end result.
That's a good point. Maybe ad-blockers will impose accountability.
Edit: There's a tendency to be irresponsible when effectively anonymous. But there's still risk. Let's say that some ad network is hosting ransomware. Well over 99% of victims will have no provable damages. But maybe you take out some business and all of the day's backups. There's also the potential for class tort.