Seems you already have the basic pros and cons. To add here, I have seen a colleague who decided to break the news in advance because of good personal and working relations with the employer, and offer to help in the meantime.
Looking at Nougat has no more security fixes (3yo), is Google the bottleneck here?
Edit: Previous versions tend to live up to 3 years only. If Google doesn't have initiative to update the service, I guess it has downstream impact to manufacturer to be less motivated to do so.
I think there is more to the ContactTracing app then what Schneier mentioned.
Understand how to define a close-contact of infected. It requires a constant 30 minutes Bluetooth-strong-signal (geographically near) to the infected person, not just because your "ID" being captured on the infected person.
The app helps find these close-contacts around you and eventually notifying them to isolate themselves and test. Imagine this process chained.
Of course, this will need a scale of people downloading the app. But better-having this auto-logged than human-effort asking infected 1 by 1 (10,000+++ infected VS 100 contact-tracer)!