The business model is knowingly at risk
"They may simply have resold to a third-party that abused their trust. For this reason, it would be unfair to terminate the top level advertiser because they did not 'knowingly' participate in the malvertising"
There is no "Simply" about it, There is no unexpected about it. This is a risk in their business model that they choose not to account for, knowing they themselves are not at risk. Indeed; they get paid for delivery regardless.
Time to stop it where it stands and require all such third-party injection to be pre-edited.