For example, one definition of a "security" is an "investment contract", and what is (or isn't) an "investment contract" is defined by the Howey Test, which looks at whether:
1. It is an investment of money (or other assets)
2. There is an expectation of profits from the investment
3. The investment of money is in a common enterprise
4. Any profit comes from the efforts of a promoter or third party
The typical ICO very obviously meets all 4 elements, inasmuch as it involves a company raising money via an ICO, where purchasers of the tokens 1) give money to the company 2) expected to profit from purchasing the tokens 3) the money was to be invested in building the company's core business and 4) their hope of profits would depend on the company's actions.
> Owning a token dies not necessarily mean you now own a portion of the company or profits.
That is correct, and one of many reasons why tokens are a bad investment, but it's not actually relevant. Securities come in a thousand flavours.
(And no, the argument that tokens just look like securities, but if you read the fine print they don't actually promise profits or whatever won't fly either. If someone can show they purchased a token based on a representation from the promoter that there would be profits, the fine print doesn't matter.)