On a technical level, though, no web site has the right to know anything about the browser it is serving to, other than the content of the request headers sent to it. Including scripts that "report back" any further information about the system on which they are running is arguably unauthorised intrusion into a computer system. The owner of the client machine is fully within their rights to block such scripts from running (e.g. by using NoScript), and to prevent their downloading in the first place. The owner of the client machine is also fully entitled to choose which files their browser requests from the source web site.
What the advertisers are doing, is making the downloading of adverts contingent on the service of the site. If they can manage to do this entirely on the server side, then so be it, they are not intruding onto the client's machine. However, what they are trying to do is make the downloading and execution of potentially malicious code (and it is potentially malicious, not just in theory) a requirement for access. Under EU law, this is not legal.
This does also raise questions about consent for running any scripts that are within a web page, because we are long past the days when a web site was static images and text, so there is a discussion to be had about assumed consent for the scripts which are necessary for the operation of a web site, such as the scripts that make a drop-down menu work, or load a page dynamically. What the advertisers would like to do is to make these inseparable from those used to serve their malware advertising scripts.
On a side note, ad blockers can't do very much to remove static images served from the same domain as the main content of the page, as these would be indistinguishable from legitimate content. For some reason, those using ad blockers don't see these all over the place, though. Why is this? The answer is plain: the "advertisers" aren't actually interested in presenting adverts as their primary business activity. They are interested in tracking and measuring the "user" via the delivery of the ads they do try to push, from other domains, and via scripts. No, thank you very much.
As for the malware aspect, and why I state that this is not just theoretical - the ad providers, such as google, are largely serving up whatever "advertising content" the third parties that use their service supply, with little to no checking on content or purpose. Malware regularly slips through in this way, or so I am told. Because I am savvy enough to make sure that I don't see them, I can't speak from first-hand experience of being hacked vis this route (to my knowledge).
