That would be my biggest worry as well. Although this isn't specified yet, I assume that they would develop the software for Google/Apple. IIRC the Digitale Gesellschaft, a privacy advocacy group, has mentioned this as feedback about a year ago. I don't know what was done with that though. Other issues were included in the development plan though.

Also: With how this law is worded, no one is forced to use an eID. You can go the old fashioned way and e.g. go to the traffic office in person.

The country's official app for COVID immunity certificates or whatever they were called was available on F-Droid at the time.