I can run banking apps like that, corporate apps like that, but I can't show a QR code to order happy meal.
In comparison the Burger King app works without problems and is very fast.
It was likely their management doing random shit to fix it. Instead of fixing real problem, which was bogus campaign rules. Reddit was full of people abusing their app discounts and ordering insane amount of food for free. It was well described.
None of that was due to app security holes. It was an issue in their promotional campaign. It was still working after those "secure" app limitations appeared.