Well, it is not about pre-mining specifically that makes it a security.

You could, for example clone Bitcoin exactly, but make a change where you recieve a billion free coins. It would be dumb, but that wouldn't be a security.

The problem is when ICOs premine and sell you a token for something that doesn't already exist yet. The token represents a future promise, as opposed to something that exist right NOW.