Are you sure there is no encryption? There is a difference between no encryption and encryption that has been broken. There is no suggestion that the methods which are said to allow the downlink to be captured (aeroscope type performance) might also provide for third party control of the AC.
Well for aeroscope to work it means there is no end to end encryption between the RC and the drone. If there was, Aeroscope wouldnt and couldn't work.
The very fact it DOES work and without user compliance as they state means that link isn't secure. Either its not encrypted at all or its encrypted with a static pre shared key (which means its trivial to acquire).