They probably have an advertiser with bad, corrupt, or malicious code. That does happen, frequently years ago with Drudge Report etc.
Good call. I was betting on the cert expiring, but I’m thinking you probably nailed it.
Except that Google own “Safe browsing site” says “No unsafe content found”.
Which is why I use ad blockers. Sites do not police the ads that appear on their sites very well. The ad conglomerates that spoon these ads out do not police them either.