If we only focus on the security part, how the do you know it's even their site you're visiting? Often those qr codes are just stickers on table, trivial to slap a new one there

But it also adds a lot of annoyance for customers who came to eat food, not doomscroll on their fucking mobile phone