ICOs, just like any other investment opportunities, need to be researched properly. Not all ICOs are scams, some are great ideas backed by a reputable team. Just gotta do your homework.
The ones that win are those who get the discount prior to ICO and then liquidate during the ICO for a main currency like bitcoin/Etherium. Which is nothing more than the standard boiler room scam, updated for 21 century technology.
You get tokens deposited to your address, free. It's one of the cool things about cryptocurrencies, people can just give you random monies without your approval.
if the airdropped token is a security token, then it's illegal. And since this a gray/developing area every token has a high chance of being classified as a security token.
This also may result in unwanted tax and other liabilities on the receiver's side.
It's a flaw in Push payments design. Either receiver need to confirm tx or use a design based on Pull payments.