Don't forget the malware that installs over exploited ad networks every few months.
And the inevitable responses from websites: "I'm not responsible for the malware you got from my site, all I did was let an untrusted 3rd party inject arbitrary content into the page, and they did a bad thing with it! Nothing I could have done to prevent it!"
Except, you know, not letting some random jackass with an ad network distribute exploits through your website.