That's incorrect, the verification happens fully locally. The check app occasionally has to update trusted certificates but otherwise it runs locally. No personal data is sent to any kind of server.

It depends on location, I doubt some shop or restaurant worker will bother to scan your paper and upload it to the government. QR code scanning should work without Internet I bet if you (the group that thinks it is a conspiracy not you personally) could just disassemble the Android app and see exactly what it sends and to who.