I could see us getting to a place where ad networks that allow third party javascript are blocked. That's probably enough to deal with most malware worries, even if it's not perfect.