This sounds like FUD. An iframe can get the page it's embedded in, but what do you mean by "suck data out of people?" and how do you manipulate navigation history out of an iframe?

What surprised me most from my time in adtech was the way companies used redirects to sync user ids, i.e. news.com/story loads an image from ads.com/user-sync-start?partner=data which 302 redirects to data.com/user-sync?id=123 which redirects to ads.com/user-sync?your_id=123&partner=data&our_id=456, which returns a 1x1 transparent pixel gif. If that bothers you, disabling third party cookies should make it impossible.

That said, I use adblockers for safety because ad networks seem like a great way to serve browser 0-days.