Sure, the latest standard now is called SafeFrame which adds the necessary security: https://www.iab.com/guidelines/safeframe/

Either way, iframes are common and the ad industry is not the issue here. Many analytics providers that track all events automatically do need window access and the normal install for all of them is tag on site.