QR codes are a huge problem in contexts like this, because they are easy to overwrite and impossible for a human to verify the legitimacy of.

This means anyone with a sticker printer could slap a malicious QR code over the genuine one, and you won’t know until you’ve already scanned it. This could easily take you to a clone of the restaurant’s website for example, that instead steals your passwords or bank details.