Indeed. Some years ago a fairly well-known news site here in Norway had their ad platform hacked, and it started serving a payload that exploited a vulnerability to infect a machine visiting the site with zero user interaction and zero visibility.

The payload would then proceed to hijack the browser and intercept sessions to the most popular online bank, allowing it to redirect funds behind the scenes without alerting the user.

That's the point when I realized ad blockers aren't a nice-to-have, but an essential protection element.