Any valuable thing that isn't a commodity, is a security. Every fiat currency is a security. Stocks and bonds are securities. Etc. The government can regulate securities (or rather, regulate their issuers, because there is a clear issuer), and so they do.
The definition of security isn't really vague; it's just a definition of exclusion. Replace security with "non-commidty" whenever it comes up and things might be clearer.
Gold ownership was outlawed in the US in 1933 by FDR.
https://en.wikipedia.org/wiki/Executive_Order_6102
EDIT: "The limitation on gold ownership in the U.S. was repealed after President Gerald Ford signed a bill to "permit United States citizens to purchase, hold, sell, or otherwise deal with gold in the United States or abroad" with an act of Congress codified in Pub.L. 93–373,[19][20][21] which went into effect December 31, 1974."
The issue is when A) people buying the token are doing so because they expect the value to increase, and/or B) the value of the network comes from a central party or promoter rather than from the network participants. If a currency is pre-mined, then it's more likely to be a security because the network participants aren't helping to secure the network. Similarly, if the product doesn't yet exist, then it's more likely to be a security because the network participants are unlikely to be creating value.
The fact that the token may be pre-mined or the product may not yet exist doesn't inherently matter except to the extent that they make it much more likely the token fails conditions A and B.
Similarly, if Ethereum goes to proof-of-stake then it's more likely to be considered a security, but there isn't a specific law saying that proof-of-stake tokens are illegal.
You could, for example clone Bitcoin exactly, but make a change where you recieve a billion free coins. It would be dumb, but that wouldn't be a security.
The problem is when ICOs premine and sell you a token for something that doesn't already exist yet. The token represents a future promise, as opposed to something that exist right NOW.
The lines become much more blurred when you’re talking about a staked currency where an ICO is necessary to help evenly distribute the coins which are then mined. Honestly, as annoying as this is, the definition is security is so broad that I find it hard to picture any cryptocurrency not being defined as a security.