There is nothing per se nefarious about co-mingling customer funds, provided that you are otherwise compliant with the law.
Banks, for instance, don't just co-mingle customer funds, they invest those funds on their own behalf and reap the profits for themselves. Sometimes a bank will share a portion of its profit with its customers, in the form of intest; more often, the bank pays little or no interest, and actually charges the customer fees. A bank will risk its customers' money, and its customers will pay for that privilege.
Kraken has been operating under the money transmitter licensing scheme for a decade, and like banks, money transmitters don't have any legal requirement to segregate customer funds—although they do have the responsibility to maintain sufficient cash balances or liquid investments to cover all of what they owe to customers.
Whether Kraken is breaking the law is something that will likely be decided by a court. The SEC asserts that Kraken has broken the law, but it is not up to the SEC to decide—it is up to the courts.
It is not illegal to operate a spot commodities exchange without approval from the SEC, unless those commodities are also the kinds of securities the trading of which require SEC approval. It is also not illegal to operate as an unlicensed broker-dealer of non-security commodities, or as an unlicensed custodian of non-security commodities. The SEC only has jurisdiction over securities.
It is not in the slightest bit clear yet that the crypto tokens for sale on Kraken are in fact securities of any kind. The SEC asserts that they are, but at this point it is just an assertion. The SEC will have to win in court.