[OkayPhysicist]

Couldn't any exploit possible via that pathway also be executed based on a link? I don't see how a QR code makes the situation any worse.

[iamnothere]

Once users are habituated to scanning QR codes for verification, it becomes easier.

[OkayPhysicist]

Users are habituated to clicking links (mostly from their email) as verification, too. QR codes get a weird amount of hate for something that basically amounts to a hyperlink you can transmit through meatspace.