Why allow anything in an ad besides text or images? Why allow others to run arbitrary code through your network. Inexcusable by Google imo.
Why allow any thing on any advertisement, regardless of network, that is not image or text? Anything else opens up security issues.
"Ad networks need to be able to do their own attribution and click spam detection."
Step outside technical approach mode and look at it from the highest level possible -- why are end users ever given more than images and text, or, why are ads anything more than a very simple a href tag.
Spam detection and other protection of the ad platform should be done long before this information ever goes to the eyeball product owners.
You will have headless browsers simulating clicks and so on. This gets extremely hard over time fake, and the more signals there are, the easier it's to spot anomalies.
In a way, the thinking is - a malicious actor will get at least a few of those signals inorganic and ML can detect them...
"Long before the information ever goes to the eyeball" => wish it was true.