2) A lot. Publishers relying on clickbait to generate money. Advertisers creating invasive ads with autoplay sound and video. Ignoring do-not-track requests as part of the industry (even if some technology providers respect DNT, it seems like a lot don't). Malware. A lot of useless metrics. Bandwidth usage. Etc...
3) Micro-payments vs delivering content only when an ad has been seen? Validating content delivered through exchanges. A better way to anonymize data used for tracking? Smaller ads. Honestly, I'm not too sure, there's probably a lot that can be done but I feel the industry did too little too late.