There are multiple independent open source implementations of the SMART Health Card QR standard. It's really just some JSON + compression/encoding/digital signature.
The approach I have described is being used across Canada, and based on what has been indicated so far, this is in fact the intended direction of the federal government.
Vaccine passport checks are not conducted by government officials. They are conducted by the private businesses where the checks take place.
iOS 15 includes "app privacy report" functionality, and if the government were secretly submitting a different version to the app store than they claim they are (with secret reporting of scan data back to the mothership included in the app store builds), they would be trivially caught by anybody using this feature. It would show up in the network traffic logs that are available for anybody to inspect.
Mobile applications are also not that difficult to decompile to identify hidden functionality.
We can both be pretty sure that no tracking is taking place, and that it would be unrealistic for this system to be used for tracking purposes without that becoming a matter of public knowledge rather quickly.
As for tracking by private companies. At your local pizza shop your location may not be tracked through the open source clients you list but at larger venues the opportunity for information gathering/sharing is possible. Previously one could buy a ticket to a game from someone outside now everyone eventing must identify themselves.
You download a QR code from the government. You are identified at this point and linked to your test results given your QR code.
Those open source clients are for BC only. Assuming the app store version matches those clients that ensures you are not being track in private businesses during a vaccine check.
This doesn't ensure the federal system is using the same clients or other provinces.
This doesn't ensure a vaccine passport check before boarding a train by a government official doesn't link your travel/location.
The only thing we are sure is this will protect tracking at the private level in BC if the business has airplane mode on and both have downloaded and built the client themselves.