That does seem like a problem, but there are more than enough bits in QR codes to handle some kind of authentication and permission system.

Maybe treat default QR codes as sandbox-browse only, but other QR codes could be "signed" as coming from a trusted source, and given greater permissions.

Seems like a good opportunity for a QR code app developer to come up with a security standard, make it open, and provide a simple toolchain to build trust on top of QR.