The SEC can continue to force crypto firms to give back money they raised via ICOs—but there are limits.