I tried looking for how they're attacking ELRS (control link), and I'm seeing nothing.

There's Joachim's LoRa library. However ELRS uses the 2.4GHz and its a blend of LoRa and FHSS. Basically you need a BladeRF or better to attack the control link properly.

And given the RPi platform, they're likely using RPITX as the SDR transmitter. Lucky to get 1MHz bandwidth... And you need 80MHz minimum.

And the RPi doesn't have the horsepower to properly do 20 or more LoRa channels, with 112MHz mode on Blade.

Until I see a BoM, code, or demonstration, I'm going to consider this to be hogwash.