Well, it wouldn't be the target for your small personal blog... once you approach it at a small business level, it means running server-side code do deliver ads injected into your content that reports what data can be reported upstream.

It does mean more limited analytical data, but it would also mean better privacy constraints... it means moving the delivery to first-party servers, that can use other SaaS behind that.

As to advertizing, it means delivering an image url, and a target url... no more leaps and bounds of JS, or for that matter layers of iframes..

TBH though, if browser vendors simply disabled JS, and iframes more than 3 layers in, and limit JS files to 3 max (100kb size limit) within an iframe, the advertizers would probably successfully self-correct..