They can still count clicks and views- you know if someone visited your site or not from an ad that uses a custom URL- so if that is what you want to measure, your don't need any JavaScript. If you find a publisher is sending you too much garbage (fake) traffic, you don't advertise with that publisher anymore. Thus it behooves the publisher to do fraud prevention on their end.