Ripple putting XRP on exchanges for trading (and funding their operation with those sales) is NOT an investment contract, and therefore not a security.
Ripple paying people in XRP is NOT an investment contract and therefore not a security.
XRP is NOT a security in and of itself even when offered through a securities transaction.
Ripple selling XRP directly pursuant to contracts was an investment contract, and thus a security. Ripple had fair notice that doing this without registration was illegal. And a jury will be needed to decide whether Ripple execs aided and abetted this unregistered issuance.