Yeah, but somewhere H&R Block purchased the inventory. You don't just generically purchase a 300x280 banner ad without regard to where or how it runs. It has to be connected with some sort of property or impression.
It could be a re marketing add, or a demographically targeted ad, but in that case the buyer still purchased it somewhere and some company or company is responsible.
Ex: ISP signs a contract with "Google Ads for Publishers" to carry their display ads. H&R block buys a retargeting campaign through AdRoll. AdRoll runs this campaign by bidding on the matching cookies through AppNexus. AppNexus feeds into DoubleClick which serves Google's ads. H&R block shows up on the Apple website. H&R is 3 companies separated from their buy and where the ad is shown, and never signified any intent to advertise with an ISP or with Apple. Tracking back the ad to where it was sold gives you AdRoll, which wasn't complicit in the scheme either. Google is the "root" problem in the fictional example.
It could be a re marketing add, or a demographically targeted ad, but in that case the buyer still purchased it somewhere and some company or company is responsible.