Agreed, whenever you divulge any info, you're always losing bits of randomness (obviously, more or less depending on how good the protocol is!).

In particular, given an adversary who has several points (receiving these codes) and knows the receiving location of each of these points can de-anonymize a person "A" who is COVID positive if they know, e.g., a minimal amount of A's usual daily movements (from cellphone tower location, for example).

That being said, the government probably has better ways of knowing who has COVID-19 and other infectious diseases :)