I think parent comment meant putting up a captcha on the website for suspicious traffic, the way Cloudflare does.
I don't think anyone is silly enough to suggest putting captchas on ads.
I mean on the page content. Using something like Google's Recaptcha would reduce friction for legit users.
How would it "reduce friction for legit users"
I think there was a time that was true. Now reCAPTCHA is so prone to tagging someone as a bot if they employ any ad blocking or tracking prevention that it significantly interferes with web use. It's an overall harm to the web in my opinion.
AFAIK attackers only need to actually access your content once and extract the ad embed. Please correct me if I'm wrong.