I agree around usage of Firebase here because no one really knows what data is being sucked up there but it looks like the intent of usage here is pretty clean;
If you look at the code Firebase is in there because the push notifications to notify of infection are sent via Firebase Cloud Messaging.
I also grabbed the Google plist out of the IPA from the app store and it has analytics turned off.