If a QR Code plus the user clicking through some authorizations can compromise the device, that may or may not be a defect in the software. It's very hard to totally eliminate this type of channel ...

I honestly do not see what other method should be used. QR codes are pretty good to transfer information locally. I mean sure, you could ask the user to type it, but I do not think that is practical ...