No, Apple and Google are not designing apps. They’re designing a software framework, including provisions for security and privacy. That software framework will likely be included in an upcoming software update. On Apple devices, it will be turned off by default and users will have to turn it on via a setting. (The same will probably be true for Google’s Android devices.)
Then, for the installed and enabled framework to actually be used, people would also have to download/install an app that knows how to use it. In some cases this app could come from a (trusted?) state or local public-health agency. Where public-health agencies do not write or otherwise offer an app, there may have to be some other provider. It is possible that Apple and Google will also offer relevant apps of their own.
Finally, even if you enable the framework and install an app that uses it, for all intents and purposes you’re still anonymous – unless you test positive for the virus and you and your physician decide to report the test result via the app.
And upon making that decision, you’d be in virtually the same situation privacy-wise that you’d have been in if contact-tracing were done entirely without the help of your mobile device, except that the software could help make the process faster and more reliable.
Even at this very moment, without any known contact-tracing software enabled on our mobile devices, the chances are that numerous apps we’ve each chosen to use are collecting and (properly?) using a great deal of information about us. So, even at this very moment, there is a risk that Apple, Google, unscrupulous app developers, hackers, government agencies, and hackers hired by government agencies can all do nefarious things using information we’ve made available.
Enter the pandemic.
Contact-tracing is a powerful tool that can be used to control the spread of the virus. Yes, as with everything else on our mobile devices, there is a risk that it can be abused. We have to decide for ourselves (1) whether Apple or Google have a record of doing enough over the years to mitigate the threat to our privacy; and (2) whether any protections they further include are sufficient for us to enable this sort of automated contact-tracing on our mobile devices.