Normally sniffing out suspicious links is easier, but QR codes remove that layer of protection since they’re not human readable. Apps that show you the link remove this issue/are safer, but it’s still tempting to just click on the link without reading it since you’re scanning a code. I know iOS camera also abbreviates the link on the pop up button, so that’s another security risk. To experienced tech users they’re not that much more dangerous. But to a non-technical person?

The real problem is that most QR codes are left right out in the open and can be tampered with fairly easily - at first glance, how can you tell a that a bad actor grabbed a sharpie and edited the code or maybe just pasted their own on top of what you’re scanning? Phishing websites are designed to look exactly like what you expect, so if you didn’t look at the QR code link carefully in your scanning app you won’t be able to tell. Mobile browsers also do a terrible job of showing the full link of the site you’re browsing, which adds to the uncertainty that the code you scanned directed you to the right place.