Only if you are outside without Wifi you have to do another step, setting up a Wifi hotspot, but that is not hard. And in most situations I have been in both devices were in the same network anyways.
This assumes that the user has a level of technical knowledge that most people don’t have.
Edit: Ah maybe you thought setting up the server is an additional step. It is not. Share via HTTP is the server. It runs directly on your phone. The URL points directly to your device.
You scan a QR code to connect to someone's wifi.
All your traffic can now be captured. DNS requests will be logged. Some traffic might be redirected. When will the connection be closed? What if someone shows you a different QR code, and you're not that tech-savvy. For example a phishing webpage which asks for the user's password. Many many many people will still just enter their single-password-for-everything. What if the QR code is a deeplink to an app.. for example to a conversation on or whatever. Or maybe someone was previously logged in into some account.