As long as they don't do any advertising they should be okay. But if a single non-accredited investor lands on their website as the result of clicking an ad, the law has been broken.
Fig is legal because of a recent crowdfunding law that made it possible to buy equity while funding a project. I think the website was created right after the law passed too, but maybe my memory is fuzzy here
Just offering an unregistered security to the public (without any exceptions applying) is a violation.