In this [0] PyCon talk the app is reverse-engineered, and a version that produces a fake QR code that gets verified successfully is created.

It would seem the current approach is fundamentally broken.

[0] https://www.youtube.com/watch?v=oux3tI2V0sY