There's many (perfectly legitimate) buyers out there for whom this would be a deal breaker. If you don't run the adverts through my server (i.e. including using JS on my adserver) then you won't be serving my adverts. And in the world of media buying, that's not at all uncommon.

> let your advertisers run JavaScript in ads without letting them inject script tags pointing to external URLs

How would you do that? That's equivalent to the halting problem. There is an infinite number of ways to assemble code that will execute arbitrary code, which can can assemble code that will execute arbitrary code, which ...

It means that every piece of the code must be examined by a human. That's expensive.