There have been reported cases of using qr codes for phishing/malware distribution. Previously they still required users to actually use a qr code scanner, now I need to simply glue some qr code at a famous tourist photo spot and bang lots of people accessing the site (does the indexer execute js?).