How the fuq did he know about the proposed attack, unless he has the ability to see any, and all communication relayed through his cloud of satellites.
The data would all be encrypted, but Starlink can see
a) who is using the data (i.e. it’s the UA military),
b) where the data is being used (each starlink satellite covers a relatively small area to begin with, then you also have triangulation),
c) patterns of data traffic (bit trickier to figure out, but I imagine drone-control traffic will look different to web browsing or watching YouTube), and
d) the schedule of starlink satellite availability for that area (presumably any attack relying on starlink will be timed so that there is a good number of starlink satellites overhead for the duration of the attack, to ensure reliable connection)
Even just with (a) and (b), if you see a bunch of UA military-owned connections heading out into the Black Sea, it’s pretty obvious that there’s an attack in progress.