Traxxas ALIAS

The 1st byte seems to be the state byte. 0x01 is a normal transmit (from Tx). 0x07 is a request from the Tx for telemetry. 0x03 and 0x04 are related to binding.

I see 2 likely cases here:
1) There are some steps missing in the binding procedure. In this case, my guess is that the Tx/Rx remember the previous Tx/Rx and if they see the same as last time, skip some of the binding process. For instance, the Rx never receives the mfgid from the tx. If it recalled it last time, this would be possible, but it doesn't explain how the Rx would ever see a 'new' tx.
2) The entire binding session is dependent solely on the Rx. Every Rx will transmit on channel 0x1a with a CRC of 0x2828 and SOP code of e2 f8 cc 91 3c 37 cc 91. The Tx does some math and determines the proper channel/SOP/CRC to transmit with. If this is the case, it is especially annoying because it means we need to figure out the math to bind. replay attacks will be impossible.

Either way, we definitely need to see the Tx traces. It is likely you'll need to try to send different Rx codes to the Tx to see if it responds differently.

I found this:
latrax.com/pdfs/6639-KC1952-R00-Transmit...ing-Instructions.pdf
Which indicates there is some 'model memory'. But as the Rx has no binding mode, this means (2) above is probably more likely.

I suck at removing shields. I usually just cut them off with an x-acto and a lot of patience I need to get some Chip Quick.

Back on topic, is the MCU visible somewhere? or is it on the underside of the board that is soldered sown to the sticks? You could tap those vias, but it is annoying. I thought I'd check the FCC-ID, but a search didn't match the number on the board

Have you considered removing the LCD? It is very likely that everything would work fine without it. I don't know if you have plans for the Tx once you're done.