It was an ICO, but it's current status is no longer that---what it is known as today is a POW network---therefore is put in the same category as Bitcoin. People may not agree with that but things are as they are.

As for Ethereum being Vitalik controlled, maybe, but his influence on what happens is declining as time goes by. Important is that the CFTC doesn't look at Ethereum like that because they continue to call it a decentralized crypto.

Regarding POS, it's not certain yet that it will happen. The CFTC just focuses on how Ethereum runs today, not how it might run in 2020 and after. I don't consider Ethereum a security either. Bitcoin bulls on the other hand do.