I have just checked this and in exported firmware there is no OTP data and this is by design. I have probably confused some internal debugging firmware with production one. Sorry for giving false hope regarding that matter.
Now that the HOTP secret is overwritten on the device I am afraid there is nothing we could do further from this side.