You don't trust the QR code, all that is is information (a public key, for example). You are trusting the underlying software. (Which in crypto, isn't always the best idea either).