Which you can absolutely do, when you are Disney (read, agencies fight to run a campaign with you). When you are, let's say, TechCrunch, the situation changes - you can still strike some deals but a lot of your demand is not the same grade.

That's the first point. Now, who should be responsible for getting the ads? The website? That will absolutely kill the monetization model and it is simply unrealistic. Which means, that responsibility now should be pinned on someone else. Who would that be? My point being that no one there has an inherent lawful obligation to provide such vetting, which would be a) costly and b) only applicable to one player (out of many).

And then we get to bad actors. If I were a really motivated bad actor as early as in 2005, I was serving different creatives and different landing pages to different audiences - a perfectly well-behaved ones to Google's crawlers (again, Google does A LOT to fight malware), a questionable quality clicky ones to general audiences and maybe malware-ridden ones to specifically targeted audiences. And you would not be able to catch me in real time - only after the fact, once the campaign was run and someone looked at the evidence (assuming it was collected, which it isn't normally)