@jwildeboer I’m being paranoid here, but this looks like those USB drives with malware in them, left by spooks in the parking lot of the Iranian Uranium Enrichment facility. The vector for the infection in this case is genius.
You may want to add a bit more information about the QR or leave it out altogether. It would be great if it was directed to a WhatsApp profile (even if you already have your phone there)
https://www.cloudflare.com/en-gb/learning/security/what-is-quishing/