What about ADS? Some advertise platform give a js code snippet that generates HTML with links followed.

What we must do?

We should ask the provider to change the code to nofollow or we can ignore it?

I think there are lots of implications in this Googlebot change and how to be guidelines compliant.

People need to understand it's not just links they need be careful of but the comments themselves.

It's no good thinking that just because any links are nofollowed by your comment system that you don't have to worry to much about comments.

Some comment systems still show the comment content in the source code even when the webmaster may think the comment has been deleted.

document.write('<a href="https://example.com/">example</a>');

What if the user generated content wasn't just links?

I appreciate any links can be nofollowed (thus ignored by Google), but if the user generated content is just paragraphs of spam filled keywords, Buy Viagra here, Viagra, Viagra, Viagra for example.

Can user generated comments like that have a negative effect on the page they appear on?

Thanks for that.  I'd love to be able to support such a change recommendation with some reasoned evidence behind making the change.  Right now all I can say is that I can see the links in the cache, but cant say if Google wants us to take the same care with JS rendered links as HTML rendered links.

I understand it may not be easy for you to comment, but can you say anything about status of JS-rendered links appearing in cache (text-only) pages?

It may sound trivial to add nofollow, but on large production sites it can take a lot of stakeholder convincing to get such changes above the line.

Your help is appreciated!

document.write('<a href="https://example.com/" rel="nofollow">example</a>');