What happened with ICOs is that the SEC sent a letter to each of them asking why they hadn't registered their initial public offering with the SEC. Most of them backed off and gave the money back. A few did register for an IPO. Some outside the US stopped selling to US persons. Some qualified as "utility tokens", but for that the issuer has to redeem them for something, like a Starbucks drink or an iTunes download. To issue utility tokens, you have to also make something that has some utility.
NFTs were an attempt to evade the rules on public offerings. If an NFT represents a real thing, even a silly real thing such as a Bored Ape picture, then it's probably a collectable, which the SEC does not regulate. But if an NFT is tied to something that doesn't exist yet, it's an investment. Also, once huge "NFT collections" and "fractional NFTs" became a thing, they started looking more like securities.
There's a a long history of attempts to evade security registration by claiming your new thing is different. It hasn't worked in the past. The "Howey test" came from a 1949 attempt to sell the right to harvest oranges from orange groves in Florida to large numbers of people nowhere near Florida.
The process for simply registering an IPO with the SEC isn't what holds back crypto issuers from doing it. It's that you have to file a prospectus, explain who you are, who's involved, their backgrounds, and what you're going to do with the money. Under penalty of perjury. What crypto people call a "rug pull" quickly results in felony charges.