Indeed without my permission is implied. Without it, you have no idea what traffic is being routed and could be on the hook for something nasty like CSAM.
Those are different issues. Permission doesn't mean you know what the content is, and lack of permission doesn't mean they're going to load anything weird or bad. Lack of permission implies worse ethics overall, but an operation focused on clicking ads will be loading relatively normal sites.
No. You would not be “on the hook” for this as they implied. They are fearmongering. Even if a statute could somehow be stretched to cover it, it would be a nightmare to prosecute something like this. The media would jump all over it.