You know they don't host their own ads, for the most part? There is a network of ad servers that do automated "bidding" whenever a web page goes to serve an ad. They pick a bidder based on what they know about the page, what they know about you (cookies!) and what is being offered by their bidders. Often those bidding are networks themselves who repeat the same process. That's why loading an ad URL will go through several redirects until someone decides to actually serve content.

There are ad networks intent on serving malware and they bid to networks only a little less shady themselves hoping to hide in the mess of networks until they get to a big, high-profile page, such as the WaPo. Then they get a report of malware and have to unravel everything to find the rogue network and evict them and, sometimes, also their buyer.

This is a huge simplification, note.

Wade.