I learned recently that US companies can not self custody btc, instead they must use a qualified custodian. Can someone confirm this please?

What is the point of the SEC confirming BTC is not a security when is de facto being used as one!?