I thought part of the problem with the ad exchanges was that they're very hard to police, so what they officially don't allow has limited bearing on what actually happens.
Typically an ad will go through multiple vendors (dsp, exchange, ssp, ssp, etc) and then to the publisher. One of these will catch it, and if not a publisher as big as NYT has tools in place to catch it.
But yes things can slip through, but its mostly unapproved creative (gambling, etc) rather than code which is easy to catch.
