1) The long-term validity and usefulness of the data they are gathering. A user may be relatively net-savvy regarding the use of private browsing, they may rescind their consent on this or that advertising network to track them, their visiting son or daughter might give their device a "privacy clean-up", or they may be ironically so digitally illiterate that when their phone dies or they forget their passwords they just create a new Google account.
2) The legal risks involved in gathering, and particularly exploiting, non-GDPR (or other local law) compliant data.
With non-consensual cryptocurrency mining, both points become irrelevant. Once it is mined, cryptocurrency is a pure commodity, regardless of legality and the consent or future opinions of the person whose resources were employed to produce it.
Also, ads can have negative impacts from the thing that's being advertised if it ends up being a scam, dangerous/fake/misrepresented product or malware.