Chrome extensions are "sandboxed" in the sense that only the extension code has access to the special APIs behind special permissions. If they just inject some ads onto a page, they won't have access to the extension APIs (they do naturally have access to everything on the page itself, which is why it's still a bad thing).
It would take a reasonable amount of stupidity to manage to download untrusted code and run it in a context that has access to the extension APIs if all you wanted to do is inject ads onto webpages. But no amount of sandboxing is going to stop that, if you give the code the permissions it wants. That's why one should always evaluate both the trustworthiness and competence of the developer before granting them scary permissions.
And how would "iOS style sandboxing" prevent a browser extension from specifically injecting ads onto a webpage? If an extension cannot access and modify webpages, there's no point in having them in the first place.
At least adding ads is visible to the user. I once noticed a screen capture extension I had was sending every URL I viewed to about 7 different tracking services behind the scenes...
It would take a reasonable amount of stupidity to manage to download untrusted code and run it in a context that has access to the extension APIs if all you wanted to do is inject ads onto webpages. But no amount of sandboxing is going to stop that, if you give the code the permissions it wants. That's why one should always evaluate both the trustworthiness and competence of the developer before granting them scary permissions.