The problem is that they are currently not mandatory (at least in most countries).

I think Apple and Google should make contact tracing built-in and on by default, plus ideally there should be enforcement of activation by all places that require to pass a thermal scanner to enter.

The Apple/Google protocol is privacy preserving, so there is no "spy" concern.