The original IntrudAlert PCB has a 4 pin mystery device that drove the speaker element.

One leg is connected to the battery positive, one leg is connected to a transistor (assumed) controlled by the epoxy blob that switches to the battery negative. The other pair of legs connect to the piezo element. A search for XILIN turns up a manufacturer that seems to make a bunch of these windows sensors.

Connected scope probes to the piezo legs:

Not the waveform I was expecting to see, and especially not the 100V per division setting. Promptly disconnect probes and then double checked the 10x setting on probes. Looks like the peaks are indeed greater than ±100 volt. This makes sense that more voltage is needed for more volume.

I think next will be to test a voltage multiplying circuit or driving the 4-pin device from the MSP.