You know what I find deplorable? Spyware as a feature. Like Android.
Also, Google bypasses ad blockers. Say you have an iPhone, or an unrooted Android phone. You're blocking ads? You're using DNS to do it. The Google app, and Google apps in general, ignore the system DNS settings and use Google's own DNS. There are some good reasons they do it, but the chief upshot for Google is, they get to inject ads into a device whose owner explicitly tries to block them. Since ads can also carry malware/ransomware, Google is intentionally opening a security hole in a device you may not be able to 100% secure, but could be fairly secure. Relatively secure. For a smartphone.
I actually got ransomware on a popular Android blog through an ad they served. I'd just wiped my phone — this was the last Android phone I'd owned. So I mean, I'd wiped the internal ROM. Repartitioned it, installed a recovery (TWRP, naturally), and then flashed a custom OS. Back then, you couldn't get stock Android on a national carrier in the US. So, I was flashing a European CFW customised with the CDMA radios that the US was using at the time (we're all GSM now like the rest of the world, I think the last CDMA towers, which were 3G, have been shut down but I'm not sure — Sprint and US Cellular were CDMA and they're both part of T-Mobile, and Verizon was the big one and they're all on the GSM tech now). Anyway, I hadn't installed AdAway yet, I was just reading tech blogs, when my screen went red, said illegal content was detected on my device, pay "the FBI" so many thousand dollars in Bitcoin to unlock my device. I laughed, wiped the internal ROM again and started over... installing AdAway before going out to the open web. Lesson learned. But that's the kind of thing Google intentionally opens its users up to by tunneling around the ad blocker. (I don't name the tech blog because I contacted them and they were very helpful in identifying the source of the ransomware attacks and getting that advertiser de-listed. So there is no reason to "name and shame." But it can happen to anyone, and without even going to "shady" sites.)