"but there are LOTS of so called genuine web media outlets which don't scrutinise the advertising space that they've resold"
Perhaps they should. Perhaps there should be a bit more reputational damage for sites that don't scrutinise what ends up in their advertising space. Perhaps then we'd see the ad-brokers given the damn good kicking they so richly deserve.
After all, if you can code up a Spectre attack in Javascript, ads are a pretty major security issue.