The takedown notices do not apply to DRM circumvention measures, only copyright material.
I agree it's completely possible that a court case could rule against youtube-dl, but the only method for taking down a DRM circumvention tool is to get a court order.
Github took a punt that the RIAA weren't going to take it to court, because they don't want to risk establishing that the circumvention provisions are more limited in a court case. They got a lot of free PR out of it with little risk, that's why they did it.
As I said at the time, I wouldn't want to litigate on either side of this case. The law is badly drafted, there's little precedent, and I think it's a genuine 50/50. Any lawyer on both sides would advise you not to do so. I suspect the main reason is that the RIAA can now go back to Google and say they are in breach of contract for not preventing downloads on YouTube using technical protection measures, and push them to switch to Widevine on everything with any music in it.
The takedown request didn't claim the project was an unauthorised post of copyright material. It claimed it was a DRM circumvention measure, and US law is sufficiently vague on that matter it really can't be said definitively one way or another if that's correct unless someone is willing to litigate it.
Nobody does, in this case. Certainly, describing the request as "completely fraudulent" is wrong. It may or may not have been valid, but the legislation is sufficiently vague in most of the US and Europe that it's entirely possible this could go to court and the RIAA would win.