The SEC report regarding the DAO token states that is was indeed a security and that the ICO providers and the investors themselves were violating federal securities laws. What happens legally if a token a US resident bought/sold in the past is classified as a security by the SEC in the future?
It actually depends on the provision of the law but most times, it is applied retrospectively and the modifications for that will be set out in the guideline however, I don't see any form of punishment in that regard since the law is just coming into action as that will haphazard situation. In conclusion, if the promoters of the tokens do the right thing I believe all will clear.