"But if a single non-accredited investor lands on their website as the result of clicking an ad, the law has been broken." + invests. Right? Otherwise, AVG which is all over social media would be at fault.
Fig is legal because of a recent crowdfunding law that made it possible to buy equity while funding a project. I think the website was created right after the law passed too, but maybe my memory is fuzzy here
Just offering an unregistered security to the public (without any exceptions applying) is a violation.