> Don't many other companies (Google, Facebook, etc) manage to do that without becoming vectors for malware?

This all depends on targeting (as an HN user you're unlikely to be targeted by them as there are higher-value ads that match your profile) but at the bottom of the targeting barrel there are absolutely ads for scams and/or malware.