It’s 100% a security. There is an insider group, it started with a premine, and it is functionally the investment of money in a common enterprise which relies on the efforts of others with the expectation of profit.
Commodities don’t change security mechanisms or have a small group of developers in charge of making a way to unstake ETH. Commodities don’t roll back the chain or have insiders dump share at the top without disclosures. Commodities don’t require 32 ETH to run a node.
Frankly it’s a layup. It will fail either way, but I see this as a very legitimate risk to ETH. The debate around whether or not securities laws should exist and be enforced is entirely separate, but as it stands ETH is fucked.