You’re technically correct (the best kind of correct).

It’s trivial to attempt a connection to an ad server and detect the failure and display a dialog.

The problem is that (publishers don’t want to acknowledge) there’s no difference between advertising and malware.