How about "Using third party analytics scripts is a bad idea in general, because they can and frequently do have vulnerabilities and your trust in $BigCompany is misplaced"?
Exactly. This is what website operators need to learn. People generally don't learn lessons like this without experiencing some pain first, so in my mind skipping straight to the blocklist is the most efficient.
You need to look up what a supply chain attack actually is.
This is not necessarily malicious behavior nor incompetence, unless you consider putting ads on a website incompetence. This problem has been festering for well over a decade.
I would agree with that.