Every ad GET is doing a lot of things that violate that edict.
Yes, but if ads do it, that would at worst make the ad server vulnerable, not your server.
Yes, but if ads do it, that would at worst make the ad server vulnerable, not your server.