That article is kind of saddening because it's incredibly naive.

At the very least the "ad" was being run by someone trying to create an air of legitimacy around events like... a random popup IN YOUR BROWSER telling you about host system software you might actually need and should therefore go right ahead and install.

Oh HELL no. If it's part of someone's malware campaign, it should be categorized malware. That some dinky piece of their campaign doesn't involve machine-executable code does not matter in the slightest.

The weasely logic needing to justify allowing deliberate attempts at mis-education is how one gets sites for which navigation is rather like attempting to defuse a bomb, blindfolded, while riding a stampeding buffalo.

The bottom line, though, is that ads DO serve malware. I work for an endpoint protection company and the most common traces we get from our customers are ones that originate from ads on legitimate websites.