Any valuable thing that isn't a commodity, is a security. Every fiat currency is a security. Stocks and bonds are securities. Etc. The government can regulate securities (or rather, regulate their issuers, because there is a clear issuer), and so they do.

The definition of security isn't really vague; it's just a definition of exclusion. Replace security with "non-commidty" whenever it comes up and things might be clearer.

The issue is when A) people buying the token are doing so because they expect the value to increase, and/or B) the value of the network comes from a central party or promoter rather than from the network participants. If a currency is pre-mined, then it's more likely to be a security because the network participants aren't helping to secure the network. Similarly, if the product doesn't yet exist, then it's more likely to be a security because the network participants are unlikely to be creating value.

The fact that the token may be pre-mined or the product may not yet exist doesn't inherently matter except to the extent that they make it much more likely the token fails conditions A and B.

Similarly, if Ethereum goes to proof-of-stake then it's more likely to be considered a security, but there isn't a specific law saying that proof-of-stake tokens are illegal.

You could, for example clone Bitcoin exactly, but make a change where you recieve a billion free coins. It would be dumb, but that wouldn't be a security.

The problem is when ICOs premine and sell you a token for something that doesn't already exist yet. The token represents a future promise, as opposed to something that exist right NOW.