So as someone who works exactly on this, the best way is still exploiting the user. The "QR code scanned" notification needs to look like something useful or enticing so the download or link is opened. The glasses would never automatically download and even execute a binary without the user.

Easiest is probably some PDF reader exploit. There I can see a path of auto download and auto execute with only minimal user intervention. If the PDF has a good title you'll take the user approval hurdle easy.

Or payment apps. Some users have payments almost automated. Accidentally confirming a payment popup in the wrong moment seems like a viable exploit.