You don't have to list it in order to scam people with it. They can buy stocks even in non-listed companies. At least not listed on major exchanges. While it might be easier to make a compelling ICO, registering a scammy company is also relatively easy (1k-2k USD). Or perhaps a bit more if you want to come up with some questionable tech and defraud some VCs with experience. It has been done, it is still being done. Up to this point it has been somewhat harder to get away with it though. Now hopefully it will be harder to get away with a scam ICO too.

The point is, if you are out there trying to invest your money, and you don't have any idea about how to judge people, how to judge business models, how to judge the underlying tech - you will loose money. Whether it's an ICO or a regular company selling it's equity using traditional methods.