I feel is something missing in that algorithm of check. And... Not all services are web, not all web services are public (so mobile app will not be able to open

I feel is something missing in that algorithm of check. And... Not all services are web, not all web services are public (so mobile app will not be able to open url), and U don't understand why bots will not scan that QR.