Zero tolerance, maybe maybe not. But if I ran a restaurant and kept ordering from a supplier that kept giving me deliberately poisoned meat, I should be held responsible.

And there's a reason ads are slow, easily blocked, client-side javascript. Site operators know they serve malware and don't want it on their own servers.