The main thing ads allows is "zero-click" - so they don't need to click a link or anything to get exploited.