What's the point on securing the algorithm? Especially since this is just OATH-TOTP under the hood, with a weird key provision scheme that uses SHA1 of device'

What's the point on securing the algorithm? Especially since this is just OATH-TOTP under the hood, with a weird key provision scheme that uses SHA1 of device's ID (huh?) instead of bank- or user-provided random key. On the contrary, I think it should be open, so anyone can audit the application.