This is why I run uBlock Origin, which blocks the ad-tracking code at the network level. Pretty much anything in a third-party iframe doesn't even get to load from the server; the browser simply doesn't make the request. Doesn't stop anything the origin runs, but most origins don't; the third party embeds are generally the biggest threat.

This is also why Twitter having problems is such a big deal; as far as I'm aware, Twitter is serving their own ad-tracking code, rather than a third-party's code. Thus, it's harder to block completely, and any vulnerabilities might (somewhat) affect even users that are running privacy extensions.