I imagine Monero might similarly not count as a security? The complete lack of scripting helps that argument at least. And the raison d'etre isn't "make money" but "privacy so good even the police can't track you". Not a legally nice raison d'etre but not something that passes the Howey test either.