Obviously there's a risk that the person scanning the QR code does shady things with it but it's rather unlikely the app itself will. It would be caught really quickly.