This has been happening for years, and is used widely across the industry, more than a decade ago I worked with one of these systems to be able to associate face from a camera system with this system to add a facial identify to the data.
QR codes are seriously nothing compared to that, and the user has to actively interact with them.
Don't phone's listen only for SSID beacons? Why would they be transmitting at that time?
And yes iOS has tightened their controls on how their phones can be tracked. Most of these systems right upgrade or new piece of equipment that switches the tracking from wifi to Bluetooth or a combination of both
I know that Bluetooth beacons are a thing, but presumably leaving your phone out of discovery mode and not having any active Bluetooth pairings mitigates that, right?
As far as the bluetooth side it, I don't have personal experience with them other knowing that they were added to systems I've worked on after the fact.
So your statement sounds logically, I just can't confirm it.
I want out.