Sure, but there's a big difference between going to a sketchy, malicious site vs a reputable site that does serve ads and now being at the mercy of any arbitrary crap in the ad you didn't choose to see
The barrier to vising a "sketchy website" is minimal. For example, its super easy to have an s3 bucket that serves static html content and get a user to click on it is minimal, not only does the url look valid, but its a common way of hosting content so https is not present.