This can all be prevented easily
Advertisers just need to follow my rules, rules which were being followed once when the internet took became a life's necessity. If they worked once, they can work again.
(1) Absolutely no tracking, no exception. (2) Absolutely no ad that uses a plugin, such as Flash or Java, or Javascript, no exception. (3) Absolutely no pop-up or pop-under ads, no exception. (4) Absolutely no auto-play videos except when I click on a link to a clearly labeled video. (5) Absolutely no ads that attempt to determine my location; i.e. no "Shocking secret [city name] man discovers" type ads. (6) Absolutely no ads that block part or all of a webpage, no exception.
If those rules were being followed, malvertising would stop immediately. The web ad business model was successful once when they obeyed my rules, they can be successful again. My privacy and my security are more important than your money. I want you to make money, but not at the expensive of something far more valuable than money.