Now someone might want to check for neighbors having such QR codes on their doors and replace them with QR serving ads (and accessorily ring the "bell" applicat

Now someone might want to check for neighbors having such QR codes on their doors and replace them with QR serving ads (and accessorily ring the "bell" application), or just with something unrelated (like a page to install a rogue app). On a side note, a delivery person might actually not want to scan the QR code because (a) if you do this all the day long, it take much more time than pushing doorbell buttons, and (b) if they use their professional devices to do this, they might either have that URL blocked, or scanning a "random" QR code might be against their company's policies because it might expose them to security risks (imagine a phishing page with the login interface of the delivery company, or a site serving malware).