I think you forgot a prong in the Howey test. "With the expectation of profit from the effort of others."

There are various forms of staking, if it requires running your own validator the expectation of profit is derived from your own effort. Therefore not a security.

"Effort of others" means from the perspective of the putative investor, not the business at issue.

Or applied to this situation: Howey is applied from the perspective of Coinbase's customer's supplying the crypto to be staked by Coinbase, the business. From their perspective, the "effort of others" is Coinbase's efforts via it's staking service.

Therefore, the staking arrangement is an investment contract, which is a security. (And in most cases, the underlying staked crypto itself is also a security.)

Coinbase's staking service is Coinbase running the validator for you, and giving you a share of any profits.

Yes, but the statement you make above is in general for staking. Not staking as offered by Coinbase. My comment above clarifies that the specific details of how the staking is implemented matter, at least with respect to Security's law.

My non-lawyer interpretation is that, indeed, centralized staking offerings like Coinbase seem to fit the Howey test criteria and are at risk of being deemed a security offering. But not all staking is.