I would like to present you a completely different approach than flashing and using a third-party motor controller.
My idea is to simply replace the green box that is responsible for locking and unlocking. If we do it right, even the screen functionality might be kept.
So far I have connected an Arduino Nano to the RX/TX UART Ports of the Motor Controller, as described by M20001 (thanks again!). When starting up the motor controller, it instantly starts sending bytes to the Arduino: Unfortunately, I don't even know the baud rate that should be used for communication. So I've tested several common rates and attached the results as an excel file (values are hex-representation). The higher baud rates are probably wrong, since the program then only receives 2-3 different values. The lower baud rates have higher variety.
But even now, all baud rates show a pattern: After a while, the controller sends only one byte that is usually zero (depending on baud rate). Maybe we can find even more patterns and crack the code. For starters, the correct baud rate should be found.
After that, we can start to find out which values can be mapped to which functions (eg. third byte of each status packet is speed).