It’s pretty simple to reverse engineer an Android binary. While most Android apps ship with code obfuscation, it’s relatively easy to get around. Using that method, one could determine if the publicly available app came from the same source code (it would at least allow you to determine no extra nasty bits had been added).

iOS is a little harder. If you have the dsym files it’s pretty trivial to the same exercise as Android. NHSX could choose to release them so people could again verify it more or less matches.