I have twice been subject to an attempted malware attack, when the page I was trying to view was replaced with one containing the words "Critical Firefox Update" and the Firefox logo (an unauthorised use thereof) and which attempted to download a file (Java or JavaScript, one of the two). Fortunately I have my downloads set to "ask before saving" so was able to simply stop the download before it started; and even if it had happened and the file had auto-run, my downloads don't go to my computer but to my NAS drive, which I doubt is capable of auto-running anything (a deliberate choice, as it is intended for file management and DLNA streaming and nothing else), and the file was probably targeted at Windows and wouldn't run on any version of Linux, let alone the one which powers my NAS.
The malware turned out to be a rogue advert on a website, so I've installed Adblock Plus.
I would never buy anything from web ads, so sites are losing nothing.