That argument doesn't apply to Facebook who don't serve ads from third-party servers or with third-party code. You're just as likely to find a security flaw in Facebook's ads as in Facebook's organic posts.
Except that facebook itself is a malware/spyware that tracks you in N ways that most of us don't know, and share with a lot of people and corporates that we would not want to have access to.
