True! To made Howey test a bit simpler I'm using this article as a "measuring algorithm" what security is. https://www.coindesk.com/simplest-way-understand-dao-security/

And the article defines security a quite simple: "There was an investment of money. And a common enterprise. With the expectation of profit, primarily from the efforts of others."

Yes, in the beginning of the ETH there was an ICO which was an "investment of money". And it was public ICO so it was a "common enterprise".

While Etherium is still POW and every ETH is being mined by the miners themselves for themselves it's not a security. But POS-enabled ETH will obviously gain both of less-desired attributes  "expectation of profit" and "primarily from the efforts of others" and that why ETH+POS looks scary to me.