It's the other way around. The main site is example.com and the ads/tracking are at ads.example.com (which is a CNAME pointing to some server controlled by the advertiser). So they have the same second-level domain and are considered related origins.

Of course ads.example.com could just as well have A/AAAA records pointing to the same ad server, which would neutralize any attempt to infer separate origins based on CNAME records. It would just be slightly more difficult to administer since the owner of example.com would need to update their DNS records whenever the ad server's IP address changed—but that could be automated, and the IPs are probably mostly static anyway.