True, but the positive fundamental property of these tokens is that it is very very unlikely that someone ever messes with your device without you knowing it. Which prevents a MITM attack.
But as we've seen that security is only as good as the security on RSA's servers. Imagine if someone more sophisticated had (has?) attacked RSA's servers and avoided RSA becoming aware, how secure would your token be then?
