I think you forgot a prong in the Howey test. "With the expectation of profit from the effort of others."
There are various forms of staking, if it requires running your own validator the expectation of profit is derived from your own effort. Therefore not a security.
Yes, but the statement you make above is in general for staking. Not staking as offered by Coinbase. My comment above clarifies that the specific details of how the staking is implemented matter, at least with respect to Security's law.
My non-lawyer interpretation is that, indeed, centralized staking offerings like Coinbase seem to fit the Howey test criteria and are at risk of being deemed a security offering. But not all staking is.
There are various forms of staking, if it requires running your own validator the expectation of profit is derived from your own effort. Therefore not a security.