Qubes is my daily driver by the way. My attempt of explaining it to a layman: https://forum.qubes-os.org/t/how-to-pitch-qubes-os/4499/15
Browser escapes are cheap enough and common enough that we've seen malware delivered through advertising networks before.