Because the advertisers want to be able to load it with scripts to track stuff like viewability, fraud etc., and since they have the money they ultimately have the power.
Because that’s not how the web works. There is only one sandbox per frame and all code in that frame is in the same sandbox. It doesn’t make much sense to do it differently because JavaScript can modify the behavior of the built in objects and thus that of other scripts in the same environment.
The industry is moving in a direction where more and more ads will be sandboxed, we are just not there quite yet.