How the ads are sold is entirely unrelated to the need to do user tracking to defeat gaming the system. If you're paying for ads on the internet you have 2 choices; live with (possibly crazy amounts of) fraud or do user tracking with JavaScript.
Edit: or 3, use a metric for campaign success which doesn't rely on knowing how many impressions your ad got
I'm talking about, for example, a company that sells sports apparel contracting with a company that sells sports equipment to put an ad on their website. No advertising company involved, no worries about fraudulent clicks. No javascript needed, just an anchor tag with a specific url around an image tag. The apparel company wouldn't worry about almost all the normal metrics, just how many actual jerseys did they actually sell through this ad on average per time period. If it's more than they paid for the ad, then it was a good deal to have made. It's easy to check for fraud in this scenario. They paid for the ad to be visible for a specific period of time. All they have to do is take a peek at the website to see if they are being defrauded or not. And no information about any users (other than those who actually paid for apparel) needs to be known by anyone.
The tracking is not just for measuring success of the campaign, but also for measuring the level of service provided by the ad network. Did they put your ad on 1'000'000 websites like they promised? Or just 100?
Edit: or 3, use a metric for campaign success which doesn't rely on knowing how many impressions your ad got