Seems like site owners should be liable for the arbitrary third party content they allow ad networks to inject into their pages.

If you don't want your sites security to depend on a third party, don't allow that third party to run code on it.