Of course they are, who cares about going broke in death?

So the way I understand this to work, it’s 100% safe from the type of attack you’re describing.

You are clicking the link (asking the advertiser for the data) but then never actually fetching it.

So you can never get the malicious payload to be infected.