Earlier quoted context omitted.
This is kind of silly. When you copy open source code, it doesn't give any magic access to the people who wrote it. If there is anything wrong with it, it has to appear on the source code somewhere. The question you should be asking is whether you trust Brave to vet the source code and remove anything that seems like a problem.
It isn't silly. How about I don't trust either one of them? Brave is (and you are) saying I should trust Brave because they're going to rip out Google's tracking and insert their own instead. No thank you. I'll stick with Firefox and whatever chicanery Mozilla is up to.
Brave Ads are opt-in and client-based. There is no server side tracking of users or data in the clear. I can say more on how all this works, but I will pause here. Search for "catalog" elsewhere to find another comment explaining it a bit more.