I did exactly the same thing for a different brand of DIP-switch-addressable remote-control fan back in 2016. It's been wonderful.

It wasn't that hard; I used gnuradio with an SDR to see what the remotes were sending and just pressed buttons and flipped switches until I figured out what all the bits were. There was no encryption whatsoever.

Probably not anything more complicated than running some kind of signal receiver while clicking each button on the remote and then capturing/replaying it. I highly doubt there's much if any security around the fan remote signals lol.

Probably AI, it is really good at it. Stuff that normally takes days to reverse is taking minutes now.