Because I can no longer edit this post, I just wanted to say that I tried doing research and I'm less sure than I was initially. But I will add that just because the SEC currently does very little regulation of crypto, that doesn't mean that federal laws don't apply to it. It just means you're more likely to get away with it and there's more uncertainty about what's allowed and how crypto is thought of legally.
Lack of regulations doesn't matter, they could be still charged under generic fraud & deception laws, it is just harder. It was the same with MLM - new laws or explicit bans were introduced as it was too hard to prosecute with existing legal framework.