A bit of a shame that they used an MCU instead of an encoder/decoder ASIC, since they could've implemented something better. The fixed-code remotes I've seen use a standard IC like an HT12E.

If those weren't OTP/mask ROM, reflashing them with a different firmware (maybe even a simple rolling code?) could be an interesting exercise...