They're just another representation of a long string or number... checking or verification can be built on top of it if needed by software.
It's easier to trick someone into scanning the wrong QR code than it is to trick someone into sending money to the wrong url, email address, phone number, etc.