A QR code is just a bit of text encoded in an easy-to-read scheme (for machines). It lets you link to the app download page on the App Store / Play Store. QR codes cannot run arbitrary code on your phone.