Aren't ads in YouTube locked down to displaying a video and some plain text you fill into a template. Doesn't sound like a great attack vector. I understand this for shady file sharing sites, but in the case of yt I'm not so sure.