I wonder if it would work with airdropped photos too. Another potential attack vector is, if you are using VPN and you rotate VPN servers every day, a website can display a unique QR code that is now saved to your browser cache, and then the next day after you have changed VPN server (and now have a new IP), macOS scans the QR code and basically tells the website your new IP