In defense of this practice, it seems like the fact that ads force themselves above everything else is quite useful in preventing click fraud.

Wouldn't allowing the flash ads to have a non-window wmode make it would be much easier for malicious websites to trick visitors into clicking on ads that they weren't aware were there?