Secondary sales involve person A selling to person B. At that point it's person A's problem, not the issuer's. The exchange, however, could get into trouble for trading securities without being registered
This is not really true. Once a company exceeds a certain threshold of non-accredited owners, it automatically becomes a public company, and faces the same disclosure and controls requirements as a company that became public via IPO. That is why all competently written private stock offerings sell stock with heavy transfer restrictions, so that shareholders can't force management to take the company public.
Yes, but token buyers are not owners, presumably
The analogy is necessarily inexact,ICOs are a new beast. But they don't have to be owners. Too many bond holders can make you public as well. If the tokens are securities and the sponsor/inventor/whatever is considered the issuer, lots of token holders is a problem for the issuer.