If a project is legit and has intrinsic value, it's definitely not wrong to buy it from the exchange. Why not buy it during ICO though? It's the same token, but a lot cheaper...
ICOs are high risk, high reward ventures that could go either way depending on how well the project was made and if its hitting the interest from its target market. I've lately been researching on a project called MenloOne that's soon to launch as an ICO marketplace wherein its devs said it could help stop fraudulent ICOs with their decentralized platform that utilizes a proof of reputation algorithm. There have been no other projects like this and I can't help but wonder how this might change the way we retail investors approach ICOs.