Let's not jump to conclusion (especially since Mycelium are open source and have decent reputation). First of all, how did Mycelium show the ads?
1. Using third-party (such as Google Mobile Ads)?
2. Their own advertising service (which means each user might see different ads)?
3. Simple static image?

If they use 1st option, we should let Mycelium team know that their third-party advertising service show malicious ads.