The reason why subdomains work is that you can make the root domain go to your own site, while the subdomain goes to your ad provider. If you use a CNAME it's literally just a matter of publishing another DNS recod and you're done. Moving to a subdirectory requires setting up a reverse proxy on your existing infrastructure, and keeping it up to date every time your ad network switches domains. Hell, on a lot of platforms you don't even have the ability to reconfigure the server in such a way as to proxy through an entire ad network, so you'll have to use a platform or technology specific plugin if available.

That's why the ad industry used third-party domains in the first place, BTW - it's a zero-setup solution. Subdomains are minimal-setup; subdirectories are a huge hassle.

Can browsers look up a different server addresses to send requests to that way? I didn't think that's how DNS worked but I'm no expert.

Advertisers can't trust content people to forward requests because it would be too easy to fake them.