Doesn't that sort of reasoning make non-crypto QR resources a good target?

They could behave correctly until they see a wallet address, etc., so creating and verifying using separate means is essential.