The SEC concluded that the DAO was a security, but that they were not going to take action on it. That's within their discretionary authority. They may simply decided that they weren't going to go after this issue retroactively. They've now published some guidance on the subject, so future issuers can't claim there were no rules in that area.
Expect the SEC to go after somebody who does an initial coin offering and converts the money to their own use, without generating any benefit for the investors.
For anyone buying tokens and considering SAFT offerings, this is a good read from a securities lawyer, albeit an English one (not US):
https://prestonbyrne.com/2017/08/04/thoughts-on-the-saft/
This is also a great post in terms of highlighting pitfalls and challenges:
https://medium.com/@twobitidiot/losing-alpha-why-most-new-cr...
https://medium.com/@andrew311/thoughts-on-the-secs-initial-c...
In the post, I explore what constitutes a security by examining case law and draw comparisons to other means of raising money for companies that are typically outside the purview of securities (gift cards, Kickstarter). Hopefully this helps provide perspective.