This is not the problem. You visiting any website can lead to your computer running the same code.

The main problem is that the exploits from js to code execution or data exfil are possible in the first place. The issue is that you have JS, which is generally pretty isolated, able to talk to bundled libraries (like libwebrtc), which often contain the exploits and share the same memory space. There needs to be a intermediate layer between JS talking to any such library, like process isolation with IPC for communication.

Sure, but there's a big difference between going to a sketchy, malicious site vs a reputable site that does serve ads and now being at the mercy of any arbitrary crap in the ad you didn't choose to see