> they attribute to the ads based on the DLL hard-coding some domains related to the ad campaign

No, their attribution is much more robust than this. Neglecting those details to oversimplify your explanation is intellectually dishonest.

> there is nothing explaining how the DLL becomes zero-click compromised [...]

They do, just a little later in that same section: "Both samples use a COM hijack for persistence [...]" through a malicious DLL.

https://attack.mitre.org/techniques/T1546/015/