Chrome's protection only works in cross-origin iframes [1] and has been in beta for years. I haven't checked in a while but can't find a source that confirms that it went live.

Forbes serves a large portion of their ads in same origin iframes and so is not fully covered by this protection.

[1] https://blog.chromium.org/2017/11/expanding-user-protections...