I wouldn't even say that it's a function of maximizing ad revenue. If you wanted to maximize ad revenue, you'd run Google Ad Exchange, not, say, media.net or AdSense. AdX actually has reasonable policies around cookie syncing. Website operators do many things poorly as far as revenue optimization goes--invading my privacy is not step one for them to increase revenue.
The really big players are sensitive to the PR backlash and behave somewhat reasonably. The people out of the limelight do the really sneezy things. I think it is reasonable that most people do not expect hundreds of third parties to have their browser history dating back several years. Perhaps you trust the NYT to know your political leanings, but you don't expect that data to leak to third parties.
On AppNexus, you can buy pixel segments of users with certain diseases. That's fine, if a little creepy, until you think about how easy it would be to deanonymize that data.
Even very trustworthy actors get this wrong, btw. The government of Ontario's human rights website was, until recently, pixelling every visit to their site courtesy of the ShareThis widget, including sensitive topics like transgender rights. There was no profit motive there, just oversight on the government's dev team.
Is it naive to expect that when you visit a government page about transgender rights, you won't be added to a list of people presumed to have gender dysphoria, which a third party then sells to other third parties?
Curious people may want to research "data leakage", which is a developing field in the ad ops world to prevent some of these harmful scenarios.
It's definitely not the choice I would have made, but I got massively outvoted.