Just two days ago there was a warning on the radio that in a few cities, criminals have placed stickers with their own QR codes over the original ones on the parking ticket vending machines. So if you want to purchase a parking ticket online, it sent you to their own website, faked to look like the original one, and requested to enter CC data for the payment.

roughly 60% of all email ~~containing a QR code~~ is spam.

FTFY

Also, good spam filters will "detonate" the email and detect QR code spam. They'll follow the link in the code and check it out.

Many email providers have a 'do not load images' setting. The two I use, Tuta Mail, and Proton Mail, both have it and I keep it on. When your mom sends you a photo of her new kitten you can just 'Tap to show images' or something similar. Images will not be loaded automatically, you need to do it case by case.

For QR codes in the wild, don't scan them, if you do use something like Binary Eye which let's you see the path before they are executed. At least you will know the domain isn't cryptoscam.com