Geo-blocking US IP addresses won't work either, because an ethereum contract can't refuse a transaction based upon its source IP address (it doesn't know it). So if an ICO publishes their ethereum contract address online (e.g. via a twitter post), they are implicitly advertising to US investors.
To my way of thinking, if you're sophisticated enough to do that, you're sophisticated enough in blockchain matters to make your own investment decisions.
I'm claiming that if I understand smart contract code, I'm good at evaluating a white paper's technical claims about a project being built with smart contract code.
Also I'm claiming this makes me better prepared to invest in these projects than, say, a cardiologist. But the SEC would be perfectly happy to let the cardiologist invest, while restricting the programmer who actually understands the industry.
Anyone tech savvy enough to contribute money to an ICO is tech savvy enough to connect to a non-US VPN before doing it.