Advertisers should be held partially responsible for the ads they agree to serve. As it is they just hide behind the curtain saying they are just serving the ads, that they don’t control them.
Maybe they should be held responsible for incidents like this and malware ads sent via their system. They are the only reason that ad is being seen by the public.