The comment you are replying to was mostly about meatspace. You don't click links in meatspace, you type them into your browser by hand. The threat scenario of

The comment you are replying to was mostly about meatspace. You don't click links in meatspace, you type them into your browser by hand. The threat scenario of someone putting a malicious URL on an official-looking document is distinct from someone putting a malicious QR code on an official-looking document as the latter allows all the same malicious URL techniques that work for links while the former involves a human typing out the URL in full (and thus either auto-correcting intentional "typos" or at least having a chance to notice them). In other words: QR codes allow link spoofing in meatspace. Even if you understand phishing, you might not think to verify that the official looking document with a QR code on it placed in or on the associated official building might be a trap. The mitigation required for this threat scenario is more akin to securing an ATM.