Yea, it's insane seeing this person arguing about the nature of credit card theft when we have a million different examples of how it happens and how rarely the end user knows until it's far too late. We almost always learn about itpost ad hoc.
"I'm only talking about long-term storage" is itself a goalpost move!
For example, you have to trust the QR code takes you to the real app: https://www.bbc.com/news/articles/cwyjqg578e1o