The moment [the ad] is rendered, their device can be hacked, so there's really no defence against this, short of not using a smart phone or [not] connecting to the internet

I've looked at the discussion at the GOS but I'm still confused on whether AdBlocker would work. They say that if there is a persistent new ad, that it can take the ad blocker sometime to add it to the filter.

Maybe I'm not 100% how an ad blocker works then because I thought it prevents the ad window from loading entirely and ad windows are correctly labelled as ads? Or do they work by filtering what the ad window is trying to load data from?

That's not how ads work on the internet. You have local advertising companies that are paid by Israel to push them based on whatever algorithm is held on you (and that's if Israel wants to use the algorithm or just blast the ad to everyone like they do on Google oftentimes).

Websites don't have a "country" unless it's specified at the domain level, but that's hardly an obstacle because a local domain or .com domain could be bought very easily.

Considering that this is a zero-click malware, it means that it just has to show up on the website you're using and has nothing to do with the originating country.

So do it. Get a list of the IP ranges assigned to Canada and whitelist them, block connections to all other IPs.

I do this with several of my websites. Either geofence or block non Canadian ips.

It's not perfect, but it keeps the spam away from me.