We use these when logging in remotely, and are presented with a prompt similar to:
Username: Password: Security code:
This all seems fairly standard; you give your company username and password, followed by the code on your token. The first time you log in, you are prompted to create a PIN, which you then append to the beginning of the RSA token code from that point forward when logging in.
Why is this done this way? Isn't the RSA token itself the second factor in the 2FA? What's the marginal gain from doing this, if an attacker rubber-hoses a company password out of me, why not the PIN as well? What other attacker surface is being protected?
I will note I've done this before with a yubikey; but the 2FA there is pretty obvious.