@fversteegen FWIW, I just completed some detailed traffic analysis of the 200321 firmware, and I definitely still see DNS queries for alarm.eu.s3.amazonaws.com every time the button is pushed. In case it helps, I have details on how I installed that firmware in my post below. In my traffic analysis I also see predictable TCP and UDP connections opened every time the button is pushed, but I don’t think you could intercept these with Pihole (although you might find it possible to intercept them from your firewall). Alternatively, the doorbell reliably uploads a camera snapshot to AWS S3 when the button is pressed, which you could potentially intercept with DNS spoofing. If it helps, I can DM you a PCAP traffic capture of all the traffic generated between rebooting the doorbell and pressing the button.
Anyway, the approach I chose was a €11 Shelly Uni, powered off the existing doorbell circuit. I posted a link to my detailed blog post on the forums over here (and I would welcome comments and feedback about my approach in that thread):