Ad blockers at dns level too, not just browsers. A lot of people don’t even know how to block them, check your parents or kids (or non technical people in general) phone and you will see how they are riddled with ads. I had a dns blocker installed on my parents phones and in around 6hrs it blocked 10k queries from 3 apps only..
DNS level is more secure but less effective because apps and website can serve the essential content on the same domain as the advertisement. It will also become less effective over time.
YouTube does this, so you need to use a browser-based ad blocker.
I personally also block access by web browsers to non-standard ports (aka not :80 or :443) via an app firewall (Little Snitch here). In this case it would have warned me when the compromised script would have called home to that endpoint on the non-standard port.
Gotta tackle such issues at different places all at once for sure. It's like wearing 5 digital condoms at once. Too bad there's still some leakage somewhere for sure. B)