Hmm, that's a little frustrating on the RFID front. I can only assume it's in progress with M5Stack for release (I couldn't see it either in UIFlow2).
I had a look at the Hackster project, and I think they've been a little tricky with the hub implementation. If you look closely at the images the hub appears to be the 1-to-3 Hub (which operates differently to either the PaHUB or PbHUB).
I think they have connected the Servo and PIR to the hub Groove connector:
Pin 1/White input from PIR (Pin 2/Yellow not used)
Pin 2/Yellow output to Servo (no Pin1/White)
5V and GND in parallel. Connected to GPIO Port B (Black) on Core.
Then they've gone for the PaHUB (PortA-Hub) I2C (Red) to connect the other sensors.
I don't think you will be able to daisy chain your Servo via the PaHUB because it is I2C not GPIO. The good news is the CoreS3 has more ports to play with. Looking at the very tiny image on the CoreS3 documentation, I think Port B GPIO (Black) I/O is on G8/G9 respectively i.e. connect output/G9 to the control line of your servo.
Port Pin NOTE
PORT-A(RED) G2/G1 I2C
PORT-B(BLACK) G9/G8 GPIO
PORT-C(BLUE) G18/G17 UART(RX/TX)
It might be worth a try with your servo connected to Port B GPIO (Black) then introduce the other hardware.
G8/I (White) --> Not connected
G9/O (Yellow) --> Servo control
Black --> Black
And then try the PWM blocks in UIFlow2 Blocky with some pauses in between. I don't know what the duty and frequency will be for your servo, so I've shown values copied from the Hackster example.
Shout back if you can at least get some movement out of it. Best of luck.