That's true to a point, but neither of those pieces of legislation actually define "insider trading" (although they do establish penalties for it). The power is more or less delegated to the SEC. There have been recent attempts to codify their present interpretation in statutory law.

https://www.natlawreview.com/article/house-passes-proposed-l...

Congress in general gives extremely wide power to particular administrative bodies that does result in conduct being treated as legal or illegal purely as a result of shifting regulations. You can argue that it "derives from" legislation at some level of removal so they're not "making law"; that's a distinction without a difference.