1. You'd have to actually click and willingly install the software to be infected.

2. Even though he's able to randomize the banner code the redirect to the advertiser's site will most likely be caught by ad blockers.

---

Still it's a pretty hypocritical thing to do when you're the creator of a plugin which aims to increase the user's security.