I see your point, but that seems highly improbable. That a bad actor would be willing and able to successfully create a QR Code that looks enough like the restaurant’s QR and that neither the patrons nor the establishment itself would notice. Not only improbable, but the roi for the scammer seems very poor.