I don't think we should try to split accountability at all here.

The ad platform that allows malware to be served to anyone is at fault.

As is the individual website that has selected to allow a 3rd party's code to be delivered to your machine without controlling that risk, often for very silly reasons.