The only way validators who have staked eth make any earnings is if they perform their validator duties. If they don't do the work, they get penalized. If they abuse or attack the network, they get slashed. Since a validator's earnings come from their own work, the whole 'To be derived from the efforts of others' prong completely fails.

There are pretty decent arguments why the other prongs fail as well.

What can be a security, is if a provider offered a managed yield service promising a certian return and guaranteed instant liquidity and then used staking in the background to generate that yield. This is what got Kraken in trouble. And why they settled so easily. Where Coinbase falls is going to heavily depend on the specific facts of their service.