Okay, so you allow me to post an advert with a direct reference to "//myhost.com/ad/campain-456/advert.js" ??? If that's the case, what's to prevent me from changing that JS file?
The safer thing to do, would be to require that the entire payload be delivered together, index.html, with images/js/css etc (uncompressed)... then do the min/merge and inline it all into the html before serving.
We don't allow any external calls/loads and strictly limit access to just DOM operations in the iframe. Not many people use JS in ads with our platform, so we spend the time to thoroughly vet them.
I do want to know what network it is - probably a fly-by-night outfit.
We can allow HTML/JS in our ads because we inspect them and only allow direct references (no external libraries) in-ad.