Of course it's a security, you have ICO that instantly makes it a security that you are selling right now to people without an available project on hand, then you have pre-mine that is not distributed via PoW making it a double security.
Atm you can even rug anyone on the ICO since the project is not live and not even done.
Having a pre-mine doesn't necessarily mean it is a security. What makes a token a security is if it gives ownership rights to a certain enterprise or if it promises returns to holders, for example staking. XPU doesn't offer returns or voting rights to governance. In fact, not even the foundation which will be incorporate with the sale funds will govern the project, it will rather be responsible on sponsoring and developing the ecosystem. Changes to the protocol will be agreed to by the p2p layer in a decentralised manner exactly like in Bitcoin.
The sale is closer to selling cloud credits before deploying a public cloud. Except in this case, they are "blockchain credits" and the blockchain won't be controlled by anyone.
I've actually just posted about this:
https://twitter.com/octavianonce/status/1668659963349151754