I recall YouTube was hijacked to show multi-hour ads during the pandemic. These are imperfect systems that can be abused at any scale.

They identified them after the fact and appear to have disclosed that. This is what they needed to do to be able to be held accountable and to do better detecting them in the future.

I block ads and ad services at the device and network level and don't use any Meta services (outside of facebookresearch models), so while I'm fortunate not to have been able to be served any of these, it's also kind of unfortunate that I'm in a relatively rare category to know to report them and how.