The SEC did just that. The first ICO-related case involved someone issuing a coin supposedly backed by gold and real estate, actually backed by neither. The SEC has been bringing the hammer down on about two crypto-related scams per month.[1] Most of them are out and out frauds. They haven't been aggressively going after every unregistered thing that passes the Howey test.

The SEC is mostly complaint driven. Someone complains they lost money in a scam, and the SEC takes a look. So they get involved in the aftermath, not the runup.

Recently, the SEC just doubled its "cyber" enforcement staff. So enforcement actions should pick up. Just in time for the flakier NFTs that promised something would happen in the future.

[1] https://www.sec.gov/spotlight/cybersecurity-enforcement-acti...