Exactly my thoughts, too. QR codes are a great tool, but also an incredibly valuable and opaque vector for scams.

The was one recently where they put scam QR stickers over parking payment signs, so users gave their credit card details to scammers. How are you supposed to catch that, as the end user? It’s not like you know the URL you’re supposed to be going to.

Normalizing scanning QR codes just to access a website is going to be abused by scammers in no time.