The rule is basically: "If you're giving someone else money in the hope of getting more money back later, it's a security UNLESS it fits into a list of exceptions, or if it meets the criteria to be added as a new exception."
So a savings account would absolutely be a security, unless it fits into one of the recognised exceptions. One of those exceptions is the existence of an "alternative regulatory regime", ie, there being some other framework, other than security laws, to protect people.
For a savings account, the fact that banks are federally regulated, and that deposits are federally insured via FDIC, means they don't count. But Coinbase's Lend program does not seem to be subject to any other regulatory regimes, so...
In fact, the very fact that they went to the SEC to tell them what they were up to and check if it was legal is a bit of a red flag. The SEC enforces security laws. The fact Coinbase couldn't go to the Federal Department of Enforcing Crypto Lending Regulations is a sign that this falls under security laws, because there is no stand alone Crypto Lending Regulations to enforce.