Oh no. Here's how an attack might go. I'm a shop assistant and show you a QR code to scan to make a purchase. Unknown to you, I'm not actually showing you the real app, but a fake app with fake QR code that will redirect you to a malicious website, which in it's turn will load the proper URL after having executed an unpatched zero-day on your device. You are sad because your device has just been pwned.

You are at the mercy of the source of the QR code, with no real way of being able to validate it before scanning.