The SEC doesn't decide whether a token is a security or not. It either is or it isn't, and the determination they make is based on work thst any company can and should do themselves before issuing any tokens in any form. There are clear methods that can be followed to know whether or not you are going to get a scary letter later.
Going through these measures to understand if what you are issuing is a security is not unusually difficult. It does take time, and often requires seeking good legal advice.
The strategy many of the worst ico's used, of trying to write their way around the very real considerations of securities laws, was poorly thought out and now they are paying the price.
There are many instances of projects that went about this the right way, I.e Filecoin, Ocean Protocol, Cardstack.