Absolutely. If the content creator and the advertiser dont trust each other enough to have the ad be delivered from the same server as the content, then why would I trust them to run whatever code they want.