It's all in the marketing.
Scammy ICO promises? It's a security.
The number of promises the Ethereum foundation and developers have made with regard to expected ROI? Pretty much zero in centralized fashion. Not a security.
If I sell potatoes on the street promising MOON RETURNS 50% a month, i'm selling securities.