Nobody, and I mean nobody, punches in URLs by hand. They put keywords into a search box, and sometimes those keywords have .com at the end for some obscure geeky or marketing reason they don't understand or care about.
So an attacker just needs to be better at SEO, or they need to register a domain. The problem still lies with visiting untrusted domains rather than the obfuscation of the URL by a QR code.
I definitely enter urls into my address bar. It would be absurd to assume I’m alone. My meters are ppprk.com (for Passport Parking) so I type in ppprk.com.
You just proved my point: that's a domain, not a URL.