The important part is to verify your QR code is correct. Even if a site isn't branded for cryptography they just have to sit and wait for input that looks like

The important part is to verify your QR code is correct. Even if a site isn't branded for cryptography they just have to sit and wait for input that looks like a bitcoin address. They can be old a reputable too - but if somebody buys that website (as has been done with other websites/browser extensions, also another user in this thread reports receiving such offers) there would be no way to know.