IMO the ad provider is fully at fault for allowing script tags and other potentially vulnerable features in ads. Why can't the ads just be static? I mean I get why they want it, but it should not be allowed, and IMO that's where the ad provider is almost fully at fault

Websites can set CSP to not allow ad providers to serve scripts. They're the ones adding those scripts to their page, and are equally at fault. Though static ads can still point people into a fraud pipeline, and websites running those ads should be held accountable for that too.

It's fully possible to individually negotiate with someone that wants to publish an ad on your site. If you choose to take money from literally anyone who wants to do so, then why would you not be accountable when they inevitably use you to target users for fraud? You chose to take their money and not even look at what you were publishing.