I don’t think it’s clear from that case that XRP is not a security - “The SEC won a partial victory as Torres found the company's $728.9 million of XRP sales to hedge funds and other sophisticated buyers amounted to unregistered sales of securities.”
It seems more that selling it on exchanges was not a violation of the law, but some of the activities around it still were.
(Edit - in fact it may not even be that, according to a footnote - "The court does not address whether secondary market sales of XRP constitute offers and sales of investment contracts because that question is not properly before the court." - so it looks like ripple aren't in trouble for selling XRP on exchanges, but that doesn't necessarily mean the exchanges aren't in trouble for it)
Conclusion of section 2: "the Court concludes that Ripple’s Programmatic Sales of XRP did not constitute the offer and sale of investment contracts."
If it's not an investment contract, it's not a security. That's one of the major points of the whole decision. Section 1 details ways that sales to institutional buyers did involve a contract.
The footnote just says the decision does not directly address exchanges. But it's hard to see how the arguments in section 2 wouldn't apply to exchanges just as well.
Sure - The point is it’s not as simple as “w00t Ripple won it’s not a security”, as the conduct of exchanges with respect to the token was explicitly not examined.
It seems more that selling it on exchanges was not a violation of the law, but some of the activities around it still were.
(Edit - in fact it may not even be that, according to a footnote - "The court does not address whether secondary market sales of XRP constitute offers and sales of investment contracts because that question is not properly before the court." - so it looks like ripple aren't in trouble for selling XRP on exchanges, but that doesn't necessarily mean the exchanges aren't in trouble for it)