> If there genuinely is an exploit, an advert blocker isn't enough as you could put it on any website as well.

Sure, but then people need to visit that website. Ad networks are a popular delivery method because it gets your code out to millions of people quickly. Putting your exploit on a new Tumblr blog doesn't get you a big botnet.