Cisco Security Cloud does use the real DUO and provides push (+ more) for the Security Cloud Customers. I have no idea why Cisco did not implement this for their CCO accounts but it is what it is.
You need to upload your new profile to the ASA via ASDM and use reference it in the VPN settings. You are essentially downloading an old profile from your headend.