This is true unless the image is served from https aswell. In that case referer is sent just as normal. I'm getting a certificate this week to serve https QRs!