If you don't want to get hacked by visiting a website, use cURL (actually, I think it had a few security bugs, so...)

The difference is that websites have rep, and google polices sites with malware protection (which firefox uses too, btw).

What about ads?

This reminds me of the argument that you should run SSH on an non-standard port. Sure, can't hurt. I'm sure it does stop many indiscriminate drive-by attacks. But it's hardly a real security solution. If your SSH server is so weak that it could fall to a drive-by attack then you have much bigger problems.

(And, FWIW, Google's malware blocking applies equally to ads as it does sites you type into the address bar)

Reputation doesn't work well enough because of ads. I think that's the gist of the complaint here.

Ads means otherwise reputable websites serve malware. Even when the ads themselves are trustworthy, they very often do not have acceptable security practices, preventing interception.