They’re basically given license to just run scripts in your browser
That's the crazy thing.
You want to show me an image, maybe an animated gif, and link it to your website where you're selling shit? Fine. Annoying, but fine.
But I don't care how many crocodile tears they shed about 'but websites depend on ad income' -- I am not letting random, unvetted advertisers run arbitrary code on my computer. I don't care if it's in a sandbox inside a sandbox. Exploits may be found, sandboxes may be escaped. And there's plenty of trouble they can get into even within their little sandbox, like running a fucking crypto miner or something.
So, yeah. Adblock and noscript everywhere and always.