The sites don't always know the ad servers have been compromised. A person visits a site, allows ads/3rd-party cookies, is surfing with admin rights, the ad servers gladly push their drive-by malware and ta-da... infected user. It's that simple...
Blocking ads, disallowing cookies (whitelisting), blocking the general ad industry is the only safe way. It's like sex: use protection.
If the site is serving up malware why patronize it to begin with? There is a distinction between an ad and malware.