Absolutely! They've been used as malware vectors numerous times in the past. One of infinite reasons to block them unconditionally and make no exceptions.
Perhaps because "national security" tends to involve a foreign adversary?
Maybe there's a useful analogue in tort law: https://en.m.wikipedia.org/wiki/Attractive_nuisance_doctrine
You've got a thing, and your thing is fine, but negligently allowing others to harm themselves (or in this case, third parties) with said thing can be a problem.
For instance, an ad network could decide to serve only static content and not accept any third-party js, greatly reducing the odds of someone coming along and using the network as a vector for malware. But the network has no incentive to do this because they make more money the other way. If they're made to cover some of the externalities of their product, they gain an incentive to not serve malware.
Running an ad network that accepts and distributes dynamic content is like leaving loaded firearms scattered around your property (in a jurisdiction without special safe-storage laws, I guess - the analogy isn't perfect).
People either freak out and shoot the messenger (either because they misunderstand how deep the technical illiteracy goes amongst the aging population or they are a member technical illiterate aging population and resist any effort to be educated), or they directly profit from it (companies that are part of China's spy effort, domestic or foreign), or they're just so goddamned dense they give excuses like "well I've never seen it, so it doesn't exist".
Also, as a side note: we probably should start considering advertising platforms a form of malware as well. Given how many systems run a WebView to display their content, and ad systems run Javascript, and it's a pipedream to ever think Javascript in a browser can ever be made to be secure (even if all it does is leak metadata and perform tracking); ads are, fundamentally, a way to inject malware and should be considered a national security issue.
And yes, I'm aware two of the largest tech companies are ad platforms that have side gigs (Google and Facebook); I, frankly, don't care. If your business revolves around a criminal enterprise that is claimed to be legal purely because of a loophole, then you should go out of business once that loophole is closed.