> Shouldn't be hard.

How can the OS tell if an HTTP request is for the Internet or for Ads? It can't.

Though Google could special-case AdMob effectively owning the ad scenario for apps which don't use the internet for anything else.

That's what I meant. It covers a good ~95% of all ads. Have any extras register for security exemption. Makes sense to me - in the context of not screwing the user over constantly.