The idea of the Corona Apps data protection feature is, that your data does not leave the mobile unless you upload it in case of a positive test. This is good insofar as the integrity of a server application is less relevant and would be hard to proof by users.
So in order for you (or somebody doing that as a public service) to verify that the critical client app (on the app stores) actually reflects the open source code you would have to compare the binaries with a self build binary. This is tedious since you need the exact same buildchain and you might need to account for differences in things like hostnames, timestamps and random file ordering.
There is a whole movement around reproducible/deterministic and verifiable builds which would make that easier, but I don't think that was part of the requirements (and is not so common for mobile apps).
Another option is to actually analyze the network traffic of the app. This can however be hard depending on the encryption and is not entirely reliable as there can be hard to find side channels or the app can decide to wait with unauthorized transfers till a certain time/signal.
So generally I expect people will try to poke holes and they could discover malicious builds, but there is no guarantee. Especially not since it also depends on the vendor provided Bluetooth tracking API.
However, I would think the risk (for example for the German App) is small, SAP, Telekom or Government has all to lose and nothing to gain from a backdoor in the covid app.