It turns out a large percentage of ads are in same origin frames. I think it's less reasonable as a platform to throttle same origin frames since malicious code can easily bypass it. But the vast majority of CPU problems from ads are accidental, not malicious.

One thing we could consider is throttling only same origin frames that are in the scrollable region. That way we don't throttle iframes used as transport, which are typically absolutely positioned above or to the left of the page's scrollable region, so there's no way for the user to get to it.