This issue is mostly seperate from Web Bluetooth: it'd be an issue even if that API didn't exist at all (though, of course, these APIs make it a little harder t

This issue is mostly seperate from Web Bluetooth: it'd be an issue even if that API didn't exist at all (though, of course, these APIs make it a little harder to use those interfaces for validating anything, though thankfully not that much harder because it's fairly easy to add some 'hey, this is really a browser and not a web page making this request' signal, as opposed to with QR codes, which are ultimately just a collection of pixels and it's the very-hard-to-evaluate context in which it appears on the device's screen which makes for that seperation.)