Having worked at a large and (within the industry) well known ad agency I think you're vastly overestimating the amount of knowledge the people making those decisions at ad agencies have regarding things like web best practices and security. For larger household name brands the ones doing the purchasing of ad space online are almost exclusively ad agencies. Even if the agency doesn't make the ad unit and the accompanying creative, they're still likely the ones negotiating the price and making sure everything gets trafficked on time. The level of client involvement varies, but it usually hovers between "none" and "too small to measure".

Frankly, the people in the agency world making the kinds of decisions about which ad network to use are not the most tech savvy people. They're typically two or three layers removed from anyone who actually understands the difference between HTTP and HTTPS. Until that changes (hint: not for another 20-30 years when the current crop of middle aged account executives is retired or dead) then ad networks won't receive any major pushback from the people who are their largest most reliable customers.

Even if every person in the agency world understood the harm of poorly made ad units tomorrow it would still take ages for any changes to occur because of existing relationships and contracts.