There are ads in the avast mobile security and these aren’t necessarily from avast, but from an ad service.
I suspect the same may well be the case for many web ad services getting malvertising (ad poisoning) an ad leading to malware.