If sites start moving to HTTP/2, is it true the untrustworthy code can be inserted into the same stream as the "content"?

Everything could be coming from the same domain/IP? This might make blocking ads and tracking more complicated?

My solution as HTTPS spreads is to MITM my own connections so I can see what is being sent and received over the wire. As the article says, it is a PITA. But it is necessary.

There are just different problems. If everyone were to block ads, they'd become harder to block. And some of the websites that rely on them would stop existing.