I much preferred a PDF to some dogshit website.

Weren't people slapping malicious stickers over qr codes to infected versions of pdf menus fishing around for old android phones?

Yes, they man in the middled my menu download. They told me that Beth's Salad had no chicken, but it really had chicken.

Your intuition about the (in)security of PDFs is outdated. 2000s era Adobe Reader on Windows XP may have been a security nightmare, but a modern PDF app running on a mobile phone OS with bulit-in application sandboxing and a fine-grained permissions system definitely isn't.

It's less about PDFs specifically and more about normalizing the behavior where people just scan QR codes off stickers and then download and execute whatever arbitrary file the page wants to serve them.

It should be (and, for the most part, is, modulo occasional 0-days) safe for regular users to visit random urls on their mobile phones, even if they trigger a download. If that isn't the case, we have failed as developers.

For your closing clause, I have bad news for you.

After reading these comments I am very grateful that I have never seen any of this garbage. The main places here that use the QR menus are those reinvented food courts (don't know the hip new name). With those you order through the website, it texts you when the food is ready, and you go pick it up. Some of them make you pay at the website and other you pay when you pickup. The advantage is that that you get to spend more time together at the table socializing rather than dispersed standing in line at various restaurant stalls. The downside of course is that you then get text spams after leaving.

How do those PDF menus even work? Do they have a waiter come around and take your order? Do you order up front and the QR menu is just a convenience in addition to a large menu sign?

Depends on the chain. At one restaurant, the waiter still came to your table to take the order.

At another, the restaurant's entire menu was online and expected you to place the order through the website so that it was nearly indistinguishable from a carry-out/DoorDash order. The only difference was that you specified a table number in the order if you were dining in.