There are several ramifications to this.
Most important, using an image of a person, living or deceased, without permission is simply wrong. That aside...
The company could try to claim plausible deniability citing it was a third party ad over which they had no control.
But this brings up the issue of a site owner being responsible for the site's content. The owner elected to use these ads, third party or not, so where does their liability begin. Does this mean you will be held responsible for any ad which you contract such as AdWords, which someone is offended by or contains unauthorized images?
So this leads to indemnification. Should you enter into an advertising contract where the advertiser does not indemnify you against damages resulting from their ad? Of course, there are damages beyond the material. How would the publicity affect your site and reputation?
Bottom line: This is just one more example of a risk any site takes when they allow third party content on their site. If the outcome is negative, then it may put a crimp in third party advertising and content usage.