'xxx' is read from the QR code. The attack vector you mention is no different than malware that intercepts your credit card number when typing it in.