What, your ad provider would just need to indemnify you for the consequences of their own fuckups. This is pretty basic stuff.

As for the ad provider, it is trivial to not deliver criminal payloads if your business starts from the assumption that doing so is costly instead of something you can foist on society for your own benefit.