Surprised this is the first I'm reading about this and on the bottom of the new page as this seems pretty darn major, though not had a play with any LoRaWAN stuff, but this feels akin to when WEP was broken in some ways on an impact level.
The LoRaWAN authors copied a lot from WiFi, which seems kind of dumb, but this sort of thing happens a lot when there is no security expert in the room. In addition, they needed to address that physical access to endpoints is easy in IoT, but they didn’t.