The website is signing up for a service. You could say that a website continuing to use the service of a known malicious ad provider is problematic, but are there any ad providers known to have not served malicious something?

I think you're also confusing multiple malicious activities occurring on the web. Data harvesting is another thing that needs to be banned into oblivion. Rarely are sites doing that natively. It is being done as a second part of service the site wants. A site/app wants naturally wants to seen analytics about how visitors are using the site/app, so they include some third party tool that provides that data to an extent at the cost of collecting/keeping that data for their own use. Want to make it easy for users to interact with social platforms regarding your site/app, they now get to collect/keep that data. That's a different thing than being served malicious ads.

The website is partnering with another business, often as their primary or only means of revenue. That is their entire business. This is not you signing up for a service like Netflix. It is a B2B partnership, and in fact, if you look at the direction money is flowing, they're the ones selling the service (surreptitious access to users' computers). It is their responsibility to choose their business partners and what ads they'd be running. If they're not doing any examination of what they're inflicting on their users, and just letting whomever's buying send whatever payloads they'd like, then yeah that's negligent at best.

"I'll pay you if you run this software on your visitors' computers without asking questions" is not a "service" you sign up for. People don't pay you as a service. That's about as shady a deal as it sounds.

Is a general contractor who subs out the electrical also blame free when the house burns down?