I'm guessing it depends on the client. Most security oriented software on iPhone at least ask for unlock code or Touch ID when opening the app.

You typically have to set a security code first, before those can be requested. My memory of setting up a new phone is rusty, but I don't recall this being a required step.

As an aside, please note that the use of a phone and the scanning of a QR code when using SQRL has been more recently relegated to an edge case. The vast majority of users will never do so. SQRL has its own sqrl:// schema.