I’ve been on the web since my college installed Mosaic on their HP-UX machines. I wanna say summer of '94. Thus, I can honestly say that I’ve seen it before the first commercial banner ad was sold later that year. I actually thought ad were worse in the early 2000’s than they are now. Flash should never have been used for that, for example. My main problem with ads these days is that there are sites where the signal/noise ratio is just ridiculously bad. In those cases, I vote with my feet and stay away.
Using the default browser on an iOS device should be fairly safe, assuming that you accept all security updates as they become available. Outdated browsers, on the other hand, are a major security risk.
For legitimate free movie sites (Plex, etc.), ads are indeed the main source of income, along with paid services like the ability to rent current movies. If you are smart about it, they may not collect too much of your personal information.
For the rest, the business model relies on pop-up based scams, hijacking machines for botnets, and ransomware.