The answer is that a link provided by an Apple AirTag is expected to be secure. Indeed, a page on an apple domain is expected to have been vetted entirely by Ap

The answer is that a link provided by an Apple AirTag is expected to be secure. Indeed, a page on an apple domain is expected to have been vetted entirely by Apple, and therefore earns a degree of trust by the good samaritan. As it stands, a malicious user can replace the entire website, still under an apple.com domain, with content of their own devising. This content can, for example, pretend to be an Apple login page, and exfiltrate entered credentials. I hope it's obvious why this form of attack is more malicious and more dangerous than simply putting up an arbitrary QR code.