hanlon's razor applies here. Sure, it could be some sort of malicious trick to get people to click their ads, ...or it could be because the ad is slow to load.
>And can set an explicit size to prevent layout shift
works great if you have tight coupling, but what if the guys in charge of the login page is on a different team than the marketing guys? What if the marketing guys want the ability to arbitrarily change ads without involving the login page team? I don't dispute that it could be made better, but it's very easy to build it badly, and there isn't much evidence that it's intentionally built badly.