1. I really need to look up case law to decide if Coinbase is right on the investment of money part here, and I suspect in part it relies on technically-detailed arguments I have no knowledge of. But if your money is locked up, it's almost certainly meets this prong, and my understanding is that staking does lock your assets for a time.
2. The not-"common enterprise" argument here boils down to "it's all down by computers, so how can it be a common enterprise?" Which feels like the sort of gotcha legal loophole that plays out poorly in courts, although I will admit that I don't know the case law in detail to evaluate this claim well.
3. Expectation of profit is derived in large part from how it's advertised, which... yeah, this is going to point towards security. I should note in particular that in trying to describe why Coinbase's staking service doesn't meet this prong sounds suspiciously like the original scheme in the case that provided the Howey test. This alone should cast significant doubt on the entire analysis.
4. The "efforts of others" again relies on the "it's just computers, so obviously it can't count, right? ... right?" style of argument as prong #2, but even less convincingly.
Like if the exact same thing was accomplished by people it's obviously a security but since it's done by code (which was magically and immaculately conceived, presumably) then it's different somehow.
It's not different. Coinbase wants people to give them money, have them do [complicated thing] then give them a return on that money.