With an open source model, though, a criminal may be able to work out a 2D image that he could print out that would identify him as a package or a windy branch.
the criminal could spend years to become a trusted maintainer so they can upload a model that's been fine tuned to ignore objects with a specific QR code.