I worked there 10 years ago and if I remember correctly, the system that generated seed files wasn't on the network. They wanted an "air gap" just for this reason.

And yes - the method for SecurID was long ago known - just read the patent.