QR codes present a much lower barrier to entry though. That means they can be acted on before it occurs to the target that they should think about what they're doing.
They're also not human readable. I can imagine scanning a QR code and not noticing that the URL is somewhat off. If I was forced to type the URL, I would probably realize that it wasn't entirely legitimate.