I'm not even sure that "leaked" is the correct word to use. He was in Afghanistan. It's hard to hide Air Force One, the motorcade, etc. They were reporting the news, i.e. what they're expected to do.

The fob's digits expire in 60 seconds. I hadn't heard that real-time phishing attacks were a problem.

Real time attacks are not currently a problem. So as another poster has already said, this effort raises the bar for attackers.