Summary: QR code contained link to malicious Android app, which had access to all the data on the phone after the given privileges were granted.

Steps required for this to go through:

- open link in QR code that points to an APK download

- install the linked app

- open the just-installed app

- grant all privileges to the app

That said, it's easy for an attacker to put their own QR code in most restaurants (because the walls/menus/tables are not clearly controlled by staff), just like it's easy to swap the restaurant's card payment terminal for a custom one and cash the payments. (Both are illegal, don't do it.)