Without a WiFi password these versions communicate in plaintext, so a passive adversary can snoop everything, choosing a password switches on encryption and thus protects against passive eavesdroppers.
Only in WPA3 do networks with no password get encryption to protect you from passive eavesdroppers.
Obviously an active MitM can work regardless, but that's trickier to attempt and unavoidably subject to detection.
If you "care about security" in the sense of not wanting random people to connect then you should not use "Personal mode" which is garbage in all versions of WPA because it relies on a shared human memorable password and (say it after me) human memorable passwords are garbage.
Use whichever of the terrible 802.1x alternatives best fits your scenario, as these authenticate specific users rather than relying on a single shared password. You can federate to allow large groups of people with something in common to all use all the networks in the federation. For students (and academic staff) most tertiary education sites in the world now offer Eduroam for example.
Or, give it all up as a bad job, and (with the caveat at the top about preventing passive eavesdropping) just stop trying to fence off your network and accept that it's the Internet and you'll need a BeyondCorp / Zero Trust security model.
The point of QR for this is to be able to actually share that high entropy 63 character string so you don't have to use a "human memorable password".
I dunno, the comment clearly says you shouldn't be putting wifi network passwords into websites, not passwords in general.
> They weren't commenting on the need to put passwords on wifi networks.
The thesis of the reply was "it makes sense to have a WiFi password even if it isn't secret". That's directly about whether it's okay to put a wifi password into a website.
Edit: some users already commented in another thread about pacakges that can do it instead.
Imagine if this was a web-based password strength meter.