In 2017, the SEC issued the DAO Report [1]. It—together with guidance around ICOs—made the status quo per the SEC super clear. Investigations and enforcement take time, but the rules of the game were known; the industry had been working to change the status quo.
If you want to know whether something is legal or not, you talk to a lawyer or (less reliably) law enforcement. When Coinbase asked the SEC if it needed to register, without—to my knowledge—exception, it said yes.
Before that afaik the only cryptocurrency the sec had explicitly said was a security was XRP which coinbase delisted