it has to be the website to start with; if the website is hosting malware, then it's the website's problem. Soon after that's implemented, the adtech companies will begin competing to solve the website's problem by promising clean, malware free ads, and will begin aggressively vetting ads. The monetization model will be preserved and the incentives will be properly aligned.

There is no universe in which 'gosh it's just too hard' is the correct answer.