QR codes are bad for security as they are opaque. How hard would it be for an attacker to replace a dining menu with their own link to a trojan?