Security in general is a performance and usability killer. If “attackers” were not a thing your internet would be much much faster, hell your smartphone wouldn’t need to encrypt itself or paying in a shop wouldn’t need a chip & pin.

What I’m saying is that a lot of applications have many attackers in their threat models, but advertisers have so far been out of scope.