> less common to have an ad that will auto-download malware without you clicking it

Less common but we just saw a week ago that malware-via-ads is definitely still happening today: https://news.ycombinator.com/item?id=49170001

This one replaced users clipboard contents with a particular bitcoin wallet address. So a few people who happened to be on their way to send some crypto pasted the malicious wallet address instead of the one they actually copied to their clipboard. This has stolen at least $100k so far.