In many places you see talk about tokens being listed on exchanges AFTER being sold in a successful ICO.
How was the token sold during the ICO? Did the buyers transfer ETH / BTC to some addresses and hoped to get tokens in return? Perhaps buying a little bit to test it and ramping up?
It seems ERC20 is just a protocol for ETH smart contracts that allow transfer of tokens. That doesn't seem to require any guarantee that the buyer will even get the token.
So in practice for successful ICOs, how dis the process of buying the token work without an exchange? Have any smart contracts been developed that can guarantee that if someone sends ETH to an address then they are guaranteed to get this new token sent to an address they control?
And finally, how do they get control of the address in the first place? If the issuer assigns them an address, then doesn't the issuer have the power to access it themselves later? If it's an ETH token, maybe they can use their own private key or something?
Basically I am looking for a complete technical explanation of what happened in successful ICOs on the level of the actual sale and issuance of the new token into some account.