If I check that the institution supports auth as a product, would account number and routing number be guaranteed to be there in the numbers field in the auth response?
Sort of.
If the account is from a US bank account, AND if the call doesn't result in an error, you're guaranteed to get account number and routing number. However, that doesn't mean that all Auth calls will return account + routing number.
For example, Auth if you call Auth on an Item that just has a credit card account, you'll get an error response back [this prevents you from getting billed for calls that don't return anything useful]. Or, if you call Auth on a bank account that is from outside the US, you'll get the numbers associated with the transfer system used by that bank (account number + routing number is a US-only system).