Spot ETH trading is not a security, but staking ETH may be.
There are pretty decent arguments why the other prongs fail as well.
What can be a security, is if a provider offered a managed yield service promising a certian return and guaranteed instant liquidity and then used staking in the background to generate that yield. This is what got Kraken in trouble. And why they settled so easily. Where Coinbase falls is going to heavily depend on the specific facts of their service.
Validating by running your own node is a-ok. Sending your tokens to Coinbase, a registered public company, who is pinky-promising you they will give you 8% returns every year, without registering this product with SEC, is not a-ok. How is that hard to understand?