Uh, no? At least in mobile OS's, the applications are isolated very strongly. And QR reader app is likely to have minimal permissions, and does not declare "bac

Uh, no? At least in mobile OS's, the applications are isolated very strongly. And QR reader app is likely to have minimal permissions, and does not declare "backgroup daemon" one -- so even if app is entirely taken over, the worst it can do is to show scary messages and redirect you to nasty URL. The former is easily ignorable, while the latter is no worse than typing random link shortener URL you found on paper.