That’s not really Forbes serving the malvertising intentionally. If your site hooks into a programmatic advertising stack, the risk of malware exists. This is from 2016, but it’s mostly true today. If a user is blocking ads and cookies and they disable their ad blocker on a specific site only, there’s little data to know about that user. So you get low $CPM on the bid which is mainly where the malicious ads win bids on actual quality sites. That’s why most top sites are very strict on who can bid nowadays.