The problem isn't just ads, though: first-party JavaScript can still record every keystroke you type, so e.g. if you accidentally type your login password into a browser window (even if no input field is focused) then you must change it.

The problem is that most of us are reading what should be static content which is instead a dynamic program written in a general-purpose language.