Isn't that actually worse option? I mean, I don't know about BTC but there are multiple instances of attacks with fake QR codes placed over parking meters. And last time I was looking for QR code generator for some random website the first one I found one "looked to be working", but actually quietly replaced the URL with own link shortening service.