This is not legal advice whatsoever. The reason why ICO issuers do this is to exercise extreme caution in fear of future regulations by the United States that currently aren't in place. They are showing legal due diligence to make sure that they are not in violation of any potential ruling. KYC and AML requirements became rampant after the SEC's DAO report. The Howey Test is a good place to start but there are so many factors that can deem a ICO/crypto a security. Even if it's token is no where near considered a security, how it's sold, marketed, amongst other things could still define it as one. In my opinion, it will most likely come down to a case to case basis in determining this.