The codes are 16 byte (ie 128 bit) numbers that are cryptographically derived from your daily tracing key. Of course all use of Bluetooth will reveal your MAC address, but this privacy concern already existed and is why many devices now rotate a randomly generated MAC address periodically.
my understanding is that the "codes" are randomly generated stuff, none based on any of the phone parameters. In which case you don't need any address. However, I am curious about collision. Same stuff happened 25+ years ago with famous Pentium bug. Intel was something like "this bug will happen only one time in 10 thousand years", except they considered those 10 thousand years happening under lab conditions, while in the production it hit so hard due to all software that used intensively, like AutoCad, that it actually happened per hour - result was disastrous for calculations for entire teams that were creating Architecture or Naval shipping research that in the end Intel issued a full recall on the entire chip line.
These are 128-bit cryptographically secure numbers that rely on thoroughly battle tested primitives. There is absolutely no way a compliant implementation would generate a noticeable number of collisions unless the underlying keys themselves were the same.
(And I would certainly expect that Apple and Google are capable of generating the underlying keys in a cryptographically secure manner.)
"These are 128-bit cryptographically secure numbers that rely on thoroughly battle tested primitives".
Oh, wow! So that's like 128 / 8 => 16 bytes? As in 16 ASCII characters? And what crypto has to do with them anyway in this context? Do explain please, I'd love to hear that. And also tell me about those primitives as well, I really need to hear their names.
If dang didn't warned me already not to feed the trolls in the past I'd say that you're full of "you know what", but since he did I'll just stop here