Or with some tweaks to the font code they could see a different URL…

This could be used for good (diverting bots away from where you don't want them) or evil (different destinations for user and other readers of the page could be used to trick people going to undesirable locations, because the apparent URL checks out find according to automated scanners).

Conventional web technologies already can handle this kind of use case, either by wrapping an image in a link tag, or using an alt= value.

I think qr code is more readable by bots than humans and I would prefer to see actual url...