They could try but anything over a medium size business likely has a specific contract with Microsoft and they probably have language preventing this kind of thing. I know my company does. And there would be a ton of pushback from any security org that knows what they are doing, since ads are a common vector for security incidents.
Microsoft is already getting their money from the corpos, it's the 'freeloading' public they are trying to squeeze revenue from.