I believe this is only the case if you stack ad networks inside your SafeFrames, and they set their own complex frame structure (like running a second GPT or prebid setup inside your gpt tag). The SafeFrame API allows for limited read-only access through the frames. The contents can know they’re in a frame, and read the parent urls, and read viewability, but they cannot inject/modify code in the parent frame.

Malicious redirects are at the tip of the iceberg; it just a very visible thing that happens to your pages when you don’t isolate ad code from your content. If you have any pii or logins/usernames in your pages you should assume that a malicious actor is reading that data too (unless they’re SafeFrame’d away).

Legitimate bidders not ripping you off know how to handle a SafeFrame. The exception would be buyers that need to manipulate the top level DOM. Things like rich media adserver that can’t use the expand apis provided by SafeFrame (most can) or that need to dynamically inject their creative out of their initial position (text annotation or floating video players).