So the way I understand this to work, it’s 100% safe from the type of attack you’re describing.

You are clicking the link (asking the advertiser for the data) but then never actually fetching it.

So you can never get the malicious payload to be infected.

There is a podcast called “the villain was right” 10/10, would recommend