ads have lots and lots of additional tracking both through JavaScript and through redirect urls (especially if JavaScript is disabled), generally the advertiser (e.g. Starbucks) does not actually host their own ads and instead the ad platform (e.g. Google Ads) tells Starbucks that people have seen the ad on the publisher’s website (e.g. Washington Post) and charges them for it, then gives a cut to the publisher

all the parties involved - the advertiser, the platform, and the publisher - all have a de facto hostile relationship towards each other so they all want to track the interactions and views themselves, and messing with the ad interactions is a great way to do it. the publisher wants to represent that they have lots of highly engaged viewers so that they can change more for their content; the advertiser doesn’t want to pay for bot interactions because it doesn’t help their brand. the platform wants to make money and not get sued