If they make claims in their ICO-related documents that the coin is not a security when it is in fact a security, then they are committing securities fraud. You're right that if they straight up said "this is an unregistered securities offering", it would not be fraudulent.