One interesting idea would be to move the advertising server-side. Just smash a ruby gem in your project, or a PHP file, and let's see how well you'll sleep when you know somebody can inject code on your server whenever they feel like it.

If that would be the standard way to go, I doubt people would just bundle all advertising scripts they can find around the web.