No idea, I'm not a lawyer. Assuming liability is a real problem presumably this is fixed by ad networks improving their vetting and offering some sort of insurance to publishers in the event malware sneaks through.

Alternatively, as mentioned in another comment, proxying might mean simply installing a managed ad-server within the publisher's infrastructure. So from an end-user PoV it looks like it's coming from the publisher's server but in reality it's still being served from a third party managed box.