[ Edited to insert: 1056 sort-of covers this, that's what I get for not having seen his latest video ]
The lesson in 1052 sort of misses the point. LPL (his videos are a lot of fun by the way and I recommend them to anyone who is curious about lock picking) says:
> So, if you are installing an access control system like this it is really important to use one that only transmits encrypted data
This would defeat the ESPKey demonstrated, but of course that product exists precisely because it's all you need for common systems today. If "encrypted data" was common the ESPKey's successor would probably be a product that sits next to the reader and gets its own copy of the raw RFID signal. Not as convenient, and less fun for doing cool demos, but still plenty effective enough for crooks.
What you actually need to do to defeat this is a bit more expensive. You need the token (keyfob, card, etcetera) to be smart enough to use the tiny surge of power to do local computation, and then produce one-time-only access codes. That would actually fix the problem, because to get the current code a bad guy needs to steal the token and that's an ordinary physical security consideration that humans are used to dealing with. This way an ESPKey gets the one-time code you just used, but neither replaying it nor copying it to a card to try later will do anything useful.
Unfortunately this smarter token would be significantly more expensive. We saw with EMV cards (payment cards) that the smart and secure option (DDA with changing cryptograms) is expensive enough that providers would often rather take a risk and give you an insecure cheaper alternative which looks identical, especially if they believe regulators, courts etc. won't realise they took the cheap option and so the risk actually lands on their customers not on them.