There are way too many project tokens to regulate and sue one by one, so the SEC seems to target the exchanges instead. Especially with how expensive and embarrassing the Ripple case alone was, with the release of the Hinman documents

There are approximately around 23,000 crypto tokens. This itself is likely an underestimate as we well know how quickly tokens are created. In this way, the SEC and other regulators would long run out of funds if they ever tried to target each project one by one especially with some good number of them going to court.

We already see how long and expensive the attempted regulation and litigation of a single token in XRP has been for them. Further, the XRP case has also ended up backfiring and embarassing the SEC with the release of the Hinman docs. By the time they get through even 1% of token, way too much of the SEC secrets and questionable decision-making would have been aired. On top of that, even if they deem certain tokens securities, the projects may simply operate overseas and out of the control of regulators.

Instead, it is a much more efficient to target exchanges instead as we have seen basically since the start of this year, where prior they were much more focused on individual projects. This of course then raises the issue and the comments that government and regulators have made around DEXes as well, such that they want KYC and "accounting" on DEXes which amounts to their desire for control. If you can suppress, kill or control the platforms where they trade you may not even need to bother with the projects themselves.