Part of the problem with security is they even when it’s legitimate, it acts like the scammers.

I’ve seen restaurants where their (legitimate) QR code is clearly printed on a home printer and used in lieu of physical menus in order to save money. If the link changes, they will simply tape the new one on top of the old, even on the most official copy you can find.