You could make the qr code extremely short lived, like 2 seconds or so.
Maybe if there's a "celebrity" that displays it on a live stream, that's a bigger issue, but there could be other mechanisms to dissuade this behaviour. Perhaps you could only add one friend with one QR code.