Then the attacker could buy ads on a site they suspect you will visit.

As long as the employee need to be able to browse the internet any whitelisting of links seems like a waste of resources.