> I think it would be less so if they just generate and present the backup security key at account creation, telling users to use this when they want to login on a different device and drop the whole ad-hoc 'scan a qr code' process.

That's exactly what I like about Matrix. I can verify other devices simply by comparing emojis - simple, easy, great. That it should work reliably is a completely different matter, but in itself it's great.